Analysis
-
max time kernel
1800s -
max time network
1690s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2023, 10:52
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://linkedin.com/slink?code=gqeJA534//aqsa0m////#YW1pZ25hbmlAZmlvcnVjY2lmb29kLml0
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
1800 seconds
General
-
Target
https://linkedin.com/slink?code=gqeJA534//aqsa0m////#YW1pZ25hbmlAZmlvcnVjY2lmb29kLml0
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133355335652380541" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4404 chrome.exe 4404 chrome.exe 4316 chrome.exe 4316 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4404 wrote to memory of 4444 4404 chrome.exe 80 PID 4404 wrote to memory of 4444 4404 chrome.exe 80 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 4600 4404 chrome.exe 82 PID 4404 wrote to memory of 3164 4404 chrome.exe 83 PID 4404 wrote to memory of 3164 4404 chrome.exe 83 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84 PID 4404 wrote to memory of 824 4404 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://linkedin.com/slink?code=gqeJA534//aqsa0m////#YW1pZ25hbmlAZmlvcnVjY2lmb29kLml01⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff03de9758,0x7fff03de9768,0x7fff03de97782⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:22⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:82⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:82⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2872 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:12⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2856 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:12⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4800 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:12⤵PID:2280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4840 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:12⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4980 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:12⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3120 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:12⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:82⤵PID:672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:82⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4688 --field-trial-handle=1896,i,8900761907400306396,8833044682452741414,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4316
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1920
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD535512e56efdc5e0c6c83d13e93cfdb4a
SHA1403579f2c48c72623c72ff37003735463e9ef493
SHA256a2181acbf7188807856f1313127761cc99621a9a0733116cb6d0aff13f616b80
SHA512602da7c3a52330f682163dcf18b8305f2e40fb7dab95a16eb624830c7b710af9ece1569ca040196127df33f153b613ba2e183e2656659013d8c1b8386d0f815c
-
Filesize
2KB
MD5c703010fea7d4ef6ed7257edd922b7ac
SHA15835a09a3b58227c039a55c2c3260a1cad0c31cc
SHA25674e0465910cd49e406991d6abc52273f5a01a223ec3df2acb5caf3df77211ded
SHA512315d52e81480f4650bd33d442cfd29ce8d138af383488af29c91811b909a0778c2108c239924439d77ce60e32dd0863b0bd253db70235083510f58177c260846
-
Filesize
1KB
MD5f61f03297db43e0cf730569c572c4179
SHA171ecb12adf6abdb7e72b53c18d58ed390040354f
SHA2562124d5584e93d8bfa9ea84fddacd8846dd922318b20e0c1fdc124c24249d3e30
SHA5120be4aa010ef7ca62e98404962ba58d17156f1ba2f500bb1e1a564fe1dc8555b57e27f41f081e192f6ab19fef27d2a82a21e35d3aa3bb7454d70885db16dcb1dd
-
Filesize
538B
MD5b69eb6f2d8ffb4b8a488983b9cf6b44c
SHA1dd4d2c4e1363fb1052e2841444e1cb4894f237aa
SHA256a69fede5d5518aa69ff1edff83d6f47bc7a45ab1513f7da943cc233b6827d93c
SHA512ecc3a2063c3f4af76d1856a8250509c4ed73cda34f98156aa738d64477e9bc4e389ad0767bf2cd282fadc57bf2d384ad2659c9abfbecbe57231a7c9d98b920ea
-
Filesize
6KB
MD5d3d7267f97a77db508f6c79bcc402523
SHA1658c5b4608dc43e7595bee2d0dee43ecdb9f9721
SHA256f49fe8892de3cc324e07f66a06ee006b762c6a7922f947e6be4750b2c2eb7b04
SHA512e7a57e31bd67d5a897b6db3beb238e3beb57f2098119ea01407559038533d573764a4a33a47d55938d664e7ad40540624212dcd5d8577347d42c00bc90469f67
-
Filesize
6KB
MD5cffc94d17247a05a7a97f726dc1cc73d
SHA1fb245ac184971b0b8eb5bbd8bd8596e25bbccb29
SHA256fb82df87d46bcb2848441de0315677f129ec17e3fa0a0a5d816c6ab9bcd40aa0
SHA51226bf3aa0d96671a37b604fabc95f3233d306f03774d89e2716534201d42e90ce59ae45f8c8ed4c5a9fa2bac485db7d9eb974138b6528a1eade690452ad5c945b
-
Filesize
87KB
MD51fad5153b12da99a8f23c932fd117eb5
SHA1a4f2d73fbacbff5830027bfe9b735b38366063d3
SHA25637a14dd1484a020d35f220ff96adf4d43acc5b8ff6c8099d1bc9adff0baf099d
SHA512d691eabecf87e3abffb40b1434925aba5b6414f162c0ebfd5008ef522f65c72a886062e067c55291af0adfcc3a394dd94b9917cadc24f8fb3a0b97e5ba5bac93
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd