Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2023, 16:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://venmo.com/legal/us-licenses/
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
https://venmo.com/legal/us-licenses/
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133358984763235892" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2276 chrome.exe 2276 chrome.exe 644 chrome.exe 644 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2276 chrome.exe 2276 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 4520 2276 chrome.exe 83 PID 2276 wrote to memory of 4520 2276 chrome.exe 83 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4536 2276 chrome.exe 87 PID 2276 wrote to memory of 4748 2276 chrome.exe 85 PID 2276 wrote to memory of 4748 2276 chrome.exe 85 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86 PID 2276 wrote to memory of 2656 2276 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://venmo.com/legal/us-licenses/1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff925789758,0x7ff925789768,0x7ff9257897782⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2020,i,11709527525958215894,7707696418403132122,131072 /prefetch:82⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1784 --field-trial-handle=2020,i,11709527525958215894,7707696418403132122,131072 /prefetch:82⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=2020,i,11709527525958215894,7707696418403132122,131072 /prefetch:22⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2824 --field-trial-handle=2020,i,11709527525958215894,7707696418403132122,131072 /prefetch:12⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2660 --field-trial-handle=2020,i,11709527525958215894,7707696418403132122,131072 /prefetch:12⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=2020,i,11709527525958215894,7707696418403132122,131072 /prefetch:82⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 --field-trial-handle=2020,i,11709527525958215894,7707696418403132122,131072 /prefetch:82⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=2020,i,11709527525958215894,7707696418403132122,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:644
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2620
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576B
MD532bed2e276bbb06d47c3ce519f7215a8
SHA1ebb59a699cf73613e6e5393d48ab5d65948d1bf6
SHA256cd8bb489c369d43383e92a39d972da3675e6716d27461006aa030e9d46c5ff45
SHA512d6612d9341c8b1be3f33a58528d355bdafb2602123e02307361892ae1910e89a8e3f4b377400ba9c63affeddf41994a5f4baa869ca61951c9bf86c83c28191d9
-
Filesize
2KB
MD5f30d22a42fac463d1def4495d3894712
SHA1d72ef15950b60b1918265d7aafae7a61a57331e6
SHA2567ceb071b17e9aa973809084c47473b6cc868b7f7eef663fa142fdef382545cac
SHA512f2c7807abec47c4b9c769c9316a5680f0d4d937e031b16647fa8fea2b9671c060cba31e48a78591bf48654e5bdd5af555560825572190516d2d6c59297da37a7
-
Filesize
1KB
MD51a801e37a4f635e66d7daa4eceaa0cd9
SHA1a845330d1b5870c075dea115dd2589250f73381a
SHA2562fca8b810fe43dc3afd51ca2e30c188f073e73b163f777fefe446f9b411bb7fa
SHA512a31da9e9dc6debc4ff65fb17959f508227bbaac2aa4ab0982f89e1ab7075bfd162f04f69aebb1afc8e0c4086c0b0b5c50ee97b48bdff5e4014dc0c41d5cc586c
-
Filesize
1KB
MD5544e0907e5df105157e83060773312fa
SHA1c91c0ec4bd55f6f95bb54d901aee076f1316d189
SHA25619620b57f1ea8ed6c5869944dd370a5fc0975ac8c7bae951d71186bdc2c0dcb1
SHA512c76d0caf1b14946eca26a9237f0a898d2ca93f9f23b316f1da28431e6e74d1f6e65cf5fbc2c1d53842b4f7a9b830aaea12a81f14ff1e20767a1aaf192d9ba14c
-
Filesize
6KB
MD5727c019c98e55efe7411538d1dacab64
SHA1af371f36db6e38e2e5b6be78961773b041b9ff70
SHA256ab3a72b0124f839a6c4533456b94ff36b7ca1b5b29d6bc91d5b132a1503fa86a
SHA51266ae215446bf882a4c983fe79e8faa4f1d99ab7f49fbef19b143e29383f2304175ccfa78a451dcfd1328a24c33b7bf186fd34036c1583a4f864a6014517f42bd
-
Filesize
87KB
MD57655dab070a36108806eef9e2b8cf565
SHA147eddee875bebc015d84650a707e31f7ab05ed31
SHA256e48a4b9c2f51e58538fdf0ca41308ccaa0a28ad5e724b8c456168c58f59780e1
SHA51247ceb310d4429921f5b8a495920165b28b1963f9e6cca1e9a062806c5a4d040652513c5a3576b1847dc337195c3819095c1a454b327a6a74dd0598a2bcc6a454
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd