Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 00:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://media.graphassets.com/output=format:webp/1G6ImDd5SeyTgMvflJlw
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://media.graphassets.com/output=format:webp/1G6ImDd5SeyTgMvflJlw
Resource
macos-20220504-en
macos-10.15-amd64
0 signatures
150 seconds
General
-
Target
https://media.graphassets.com/output=format:webp/1G6ImDd5SeyTgMvflJlw
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133342003818278219" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2900 chrome.exe 2900 chrome.exe 3172 chrome.exe 3172 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2900 chrome.exe 2900 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe Token: SeShutdownPrivilege 2900 chrome.exe Token: SeCreatePagefilePrivilege 2900 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2900 wrote to memory of 3652 2900 chrome.exe 64 PID 2900 wrote to memory of 3652 2900 chrome.exe 64 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 3248 2900 chrome.exe 88 PID 2900 wrote to memory of 4012 2900 chrome.exe 89 PID 2900 wrote to memory of 4012 2900 chrome.exe 89 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90 PID 2900 wrote to memory of 3128 2900 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://media.graphassets.com/output=format:webp/1G6ImDd5SeyTgMvflJlw1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7f3e9758,0x7ffb7f3e9768,0x7ffb7f3e97782⤵PID:3652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1836,i,1711394387417828642,8515504873216752945,131072 /prefetch:22⤵PID:3248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1836,i,1711394387417828642,8515504873216752945,131072 /prefetch:82⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1836,i,1711394387417828642,8515504873216752945,131072 /prefetch:82⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2772 --field-trial-handle=1836,i,1711394387417828642,8515504873216752945,131072 /prefetch:12⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2764 --field-trial-handle=1836,i,1711394387417828642,8515504873216752945,131072 /prefetch:12⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1836,i,1711394387417828642,8515504873216752945,131072 /prefetch:82⤵PID:3632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1836,i,1711394387417828642,8515504873216752945,131072 /prefetch:82⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 --field-trial-handle=1836,i,1711394387417828642,8515504873216752945,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3172
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1408
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53216c162caa0bc57938f3f3f77a5cb5a
SHA15c234a340398e4b8220e21434ccc35a083f48839
SHA25696a6094292c87d27d14d66f8a691d467d09da11c50f6d681e0e94a2675de678a
SHA512b3b0c7b9d80c46b242e4559b5297fe30d6ab50d1c4fab09c60e44bb5cf015d3fcfa16cfef6b68fc46707f0147d1c904ff8c20fb057842cd7774bc790356535e5
-
Filesize
6KB
MD5c91c688755940e023a2673f1994a5258
SHA1914cf23630b10df97243ed2788aaafc32b0aea39
SHA2569ac483d94df68039a519d8849d4b42235186e0b9d561129f127bc6e293e9c927
SHA5126974d5d6ce0223bc90bb68de30e8b427a6594fa00a88dd589f3d4ab5cd5c56b18ab2198d4ebf2ced71690003c3014b91b026f78e4234c08f54b8ab52272cb9d4
-
Filesize
87KB
MD5c5d749cff423651caa1a582857efefd5
SHA11ca4dcbc405c24439ebe9117bcfecb9f73c1145a
SHA25695bd7aa2bec1f2428ffaecdacefe44d9353a3eed6ff08b29f363d268b2bf5091
SHA51220f1fbe2875e0fa82639e53be8236c214e920d8d332484f303da368a7bfb4ef4e134aafa0044ffa49a92991dd8d1e7e5ff337f821ea6c9f578649dc5a656646b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd