Analysis
-
max time kernel
26s -
max time network
30s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
19/07/2023, 08:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ewr-344.ewr-rtb1.rfihub.com/
Resource
win10-20230703-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
http://ewr-344.ewr-rtb1.rfihub.com/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133342276111057365" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4444 wrote to memory of 1720 4444 chrome.exe 69 PID 4444 wrote to memory of 1720 4444 chrome.exe 69 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 3160 4444 chrome.exe 71 PID 4444 wrote to memory of 2536 4444 chrome.exe 75 PID 4444 wrote to memory of 2536 4444 chrome.exe 75 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72 PID 4444 wrote to memory of 4420 4444 chrome.exe 72
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ewr-344.ewr-rtb1.rfihub.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9b4139758,0x7ff9b4139768,0x7ff9b41397782⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1828,i,7667895215481178655,6335616468657735893,131072 /prefetch:22⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1828,i,7667895215481178655,6335616468657735893,131072 /prefetch:82⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2692 --field-trial-handle=1828,i,7667895215481178655,6335616468657735893,131072 /prefetch:12⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2656 --field-trial-handle=1828,i,7667895215481178655,6335616468657735893,131072 /prefetch:12⤵PID:4368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1828,i,7667895215481178655,6335616468657735893,131072 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 --field-trial-handle=1828,i,7667895215481178655,6335616468657735893,131072 /prefetch:82⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4232 --field-trial-handle=1828,i,7667895215481178655,6335616468657735893,131072 /prefetch:82⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0e2a9a46-b962-4f5e-868f-9a61e28c0087.tmp
Filesize5KB
MD57465f6df9454007d69e6cabd1715ccc0
SHA1dc00c87f0e58d62498e98970c0f94acb82f1b1e5
SHA2561a5e807acb868dff931760432a99f13b2d1aa7f6ede0904c44a17470d2ccb982
SHA5125e0f4929abf12f59b1bdf9f78bd5dd528ecbde083b12a31f7daf5656202d2eaba0e24b1406a622be58600bc0da158e845cebc77aade8d79df6843e1cbf933c72
-
Filesize
5KB
MD5dfc366d0f0c72807854e30e9b9fdbcbd
SHA1f16b53a8603f7d1d5c5ba9fb4a14de0b0dbe358d
SHA256c6fb21d08304fa079fa22fc46b765dc0409ec6533679023e87808f2bf339686c
SHA512770d2176de07b45de9eeb18d2700c362e7794c30d763ff63f7730fe9a98e83741a89e8b9a0fad969f595d9ceba17b5e6cad70f9bb9b7f3cedcfa32ab8f2d3287
-
Filesize
87KB
MD56aec1bd56f1daa810844b084b4d04fa5
SHA14c43926487def2e0737d6087e137b41b36cad0d3
SHA25653feeb1e6eac6733e9cac43f61e364d4592c15d8fdf141a772301e31cf8c03fd
SHA512cbbf42293495ede75b1dcb71d152b43acbdb5ca5c3d3ad2dd4ac44f3c980b1a5f4de936cc6f27b3c25fd59b4fbc687360cea59c67a2fe870bad07b2cbf8daa19
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd