Analysis
-
max time kernel
299s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 15:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://img2.tapimg.com.cdn.jcloudcdn.com
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://img2.tapimg.com.cdn.jcloudcdn.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133342551413540803" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4328 chrome.exe 4328 chrome.exe 400 chrome.exe 400 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4328 chrome.exe 4328 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe Token: SeShutdownPrivilege 4328 chrome.exe Token: SeCreatePagefilePrivilege 4328 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe 4328 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4328 wrote to memory of 4160 4328 chrome.exe 72 PID 4328 wrote to memory of 4160 4328 chrome.exe 72 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 468 4328 chrome.exe 87 PID 4328 wrote to memory of 3912 4328 chrome.exe 88 PID 4328 wrote to memory of 3912 4328 chrome.exe 88 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89 PID 4328 wrote to memory of 4856 4328 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://img2.tapimg.com.cdn.jcloudcdn.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89be79758,0x7ff89be79768,0x7ff89be797782⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1884,i,13999579007448480879,4479341760626289771,131072 /prefetch:22⤵PID:468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1884,i,13999579007448480879,4479341760626289771,131072 /prefetch:82⤵PID:3912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1884,i,13999579007448480879,4479341760626289771,131072 /prefetch:82⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1884,i,13999579007448480879,4479341760626289771,131072 /prefetch:12⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1884,i,13999579007448480879,4479341760626289771,131072 /prefetch:12⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1884,i,13999579007448480879,4479341760626289771,131072 /prefetch:82⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1884,i,13999579007448480879,4479341760626289771,131072 /prefetch:82⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1676 --field-trial-handle=1884,i,13999579007448480879,4479341760626289771,131072 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2420 --field-trial-handle=1884,i,13999579007448480879,4479341760626289771,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:400
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3068
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD525e748bec45d4e50b8b5f3dd45dc7c10
SHA1797f15a00ec224b5b0c4db2aa3813167cbc196d5
SHA256d2bad62381e9b7cea0dcf378f7dd2a8702260d6f7719c80a1243947644f6cd9a
SHA512dc1d02e17454049b02054312afba16ad25bde6a67b7709f25d156eb153810d9f0e9fbf0f50fe292f8ddbe669c6a4e5c49dfb3c30012fb66cd3d393c78fb83a7f
-
Filesize
6KB
MD52e74fe2e6de02dbdca7b28bc82d249fe
SHA134e626c2e8af9d04a008dae6fba0680217f8754c
SHA25623e3591c6029791ded43a3df5c0702fa0b5eb6c36e3ff59877fa549e14419a58
SHA5129cf5232d816f58e979426aad15f515bef7322c135f7bf107ff5c2ec4089f10a1d404bde00976390e8dc905737c692110a3cdedb87be00749f7f70821deff9350
-
Filesize
87KB
MD55f1cf0a02ebea7254c530c2c1cf3b030
SHA1071115170211b50cc94a08e1375707db0241bf36
SHA2565ae7ce9ad6c5ebee7582e5eff6cf3aa45b58fe8cc9378c615547b638f9895496
SHA512d2352e11930d896e8ed3a3131f3d478fd131e462e45f9cdca140737bf4e7cb84235a453ce8b09036e4cbbd1ac503d2070ed2b9f7cf56a09b7538aa31aececa96
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd