Analysis
-
max time kernel
1199s -
max time network
1157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 12:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://minhacontaclaros.from-ky.com/
Resource
win10v2004-20230703-en
General
-
Target
http://minhacontaclaros.from-ky.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133342426344926154" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 916 chrome.exe 916 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4076 wrote to memory of 1828 4076 chrome.exe 36 PID 4076 wrote to memory of 1828 4076 chrome.exe 36 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 944 4076 chrome.exe 87 PID 4076 wrote to memory of 5052 4076 chrome.exe 88 PID 4076 wrote to memory of 5052 4076 chrome.exe 88 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89 PID 4076 wrote to memory of 1004 4076 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://minhacontaclaros.from-ky.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd59f19758,0x7ffd59f19768,0x7ffd59f197782⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:22⤵PID:944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:82⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:82⤵PID:1004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:12⤵PID:3900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:12⤵PID:836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4540 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:12⤵PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4580 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:12⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4884 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:12⤵PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:82⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:82⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:82⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:82⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1896,i,4826744312097111330,17410489435494219254,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:916
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD558dac407e963eeecf75aa37629d71c12
SHA126dad1912e9c670a39c2cc203bb2c7c2b1098211
SHA256fcbf9f553ffe6a6a9424f39b79d2bb4ec2ff24ea4faa6d5dc790694cd0684233
SHA512a884723084423fd88c1dc26519005fb4b67456faf0266ddf125a9629639b6cb111b4b9cf468362b389eea65b76b93c7b6c94859ed6fc57431fcf4bee53666a09
-
Filesize
6KB
MD500bb53a0db9205776671c90bd0d961ca
SHA1a24bb323726e38f3e22f178dc9f9576a073d8e3c
SHA25693b347764e6c92f6b7fb64a9f27909ef0454a69c3136dd894b46547c4d929d20
SHA512d59095f428642c70c5d99b85b9e1f1b65c3db7cde263f364dd28100868d721eb12e55a212a61a3b61db79c8b21cc193169dfaa4fb4cc540294246648888a6a83
-
Filesize
89KB
MD57d070c24d64d949e25aa3cb61e1eba55
SHA1c00ae3721e8234f06d493dac3e7a27a04ee5999c
SHA256a9b513b48edbc48c1731274c91a1e29ae30a9046b1bba5b415fcf767b19ee918
SHA512ddad057d1134a200396b6d982c5795dfbcad2bbf3588589f0ec74232191f5cf440abbb78ded7e515cf80494a95f8b3622d7ab4b5cfa5cceff9ff3c292cfc4077
-
Filesize
89KB
MD552f421352bec568e9f7432ef1f1427af
SHA1b54be6c82ee413efa564d4e936bc2aedb8225852
SHA2560b427d81621bf662bc0358308bf10e9922df3d3c002eb6bbfcf9d0db469f482b
SHA512aa27cfc843425ec6f99f62fde36f85c32fe62ce6422998749b0c2407152398ffdf62e8312f8224e765b3147c10f08002c2ef2168a0e97d78d7148b8a17341185
-
Filesize
108KB
MD5be999637c24b38ca377255e1eab2b509
SHA11ea6e0284a0860c906abc3cf45db38d501723654
SHA256f18a426124d19de15153f1b7ce3e4cfe97e14cbaa61cd375b29eca404291f20a
SHA512a69fb1454bacbe388d80061d1fc041f7283aea09b535335530a0a701495cdaf7168431b08360a11cc63631c032b5b34a91ecd2239810720b3ccb051b9a1b3fe1
-
Filesize
89KB
MD5da6aae6ecfdcf32ca217ba92bf5d8ca6
SHA19ed375ff2cdf697c8c8ea534bc48e69f4b04555b
SHA2564569ebd247c14fdaded15233ce205c63597a4df8e7da1b88c386ee40c7e99fa5
SHA5124b1cd461eb5601d2db0e61e9b363f02a9397e27a162537ec2402d249eb5fd518ac902b3f9b1caaefc63700982818d9248f2eb63b462c0f0e3f497aaeb493eb7e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd