Analysis
-
max time kernel
299s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07-08-2023 16:29
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://accounts.google.com/[email protected]&continue=https://policies.google.com?rfn%3D1691372591309
Resource
win10v2004-20230703-en
General
-
Target
https://accounts.google.com/[email protected]&continue=https://policies.google.com?rfn%3D1691372591309
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133358993641092633" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1722984668-1829624581-3022101259-1000\{890C45BB-81C8-4B11-BE66-E82BD60D4411} chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 552 chrome.exe 552 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 552 chrome.exe 552 chrome.exe 552 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 552 wrote to memory of 1860 552 chrome.exe 83 PID 552 wrote to memory of 1860 552 chrome.exe 83 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 5004 552 chrome.exe 85 PID 552 wrote to memory of 3780 552 chrome.exe 86 PID 552 wrote to memory of 3780 552 chrome.exe 86 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87 PID 552 wrote to memory of 4208 552 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://accounts.google.com/[email protected]&continue=https://policies.google.com?rfn%3D16913725913091⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fcf89758,0x7ff8fcf89768,0x7ff8fcf897782⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:22⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:82⤵PID:3780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:82⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:12⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:12⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4672 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:12⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:82⤵
- Modifies registry class
PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4684 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:82⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:82⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:82⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=832 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1468
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD58bacc244556452f943c5af71bb1c1958
SHA1877807b0332fa91d2c4c0cc49076305c10994ece
SHA256f37293229f84df5dad11e47b8371e73d7bd130cebb724aee92f231ea8a626653
SHA512558109384707c890ac53b5e0c113f3be00aa4388101936c8cf039731036cdcd868fb5edadb7287927e0520c295af6a69fafb32f979d8f7ecc18252c6b34e9b62
-
Filesize
2KB
MD508f5bfd9c4b382c957f57d9a28881f90
SHA199e5fdb23409a060e8117d664535c23190357609
SHA2560b2bf7a4fd6cb1ce3601cecc6824aa767da2ad2ec31a94c028cee651a30a58e7
SHA51274e195e115f35c3b52dde99dfe48d1c0ab45147af60943e1105a5b050874c2edbde4dd819eaf0c9ebd364808603eca62b9a0508a3bc71bda28d5c2d27bfc44fd
-
Filesize
2KB
MD51777e6db917f02e573bd0ea93e587a1e
SHA159620c1a2901b28082625f7ce94d1522dd2e365b
SHA256c93db8b5b778f3fc3bc5ceeee2e677ca943bf9db1a68d4ebe22b0c083a2d8009
SHA51288db5707353e8d19e6adbf3de15495796764b12063d5f37b408d593a5aa3eb65abce023201c237372982e1940216f4a1cc9e0b52c99a03704e5c47e9713fbf2d
-
Filesize
2KB
MD54d8090be5d8eb6cb8cf4d8b8965149dc
SHA180061f57240cf0282a2820f34436972b2d447c30
SHA25643c1bf37efd441eb37037685cbcbe2f7b72adbcfceab7996974ed4d4aa66ff90
SHA51257c881c8eccc9ae244a93af77047c827c0a40b65b20de58803597e96343cbe37305e8c32ba1140e93a4349b9c4a8b197b4b0271eb8479bd672b93f0f7dce0c38
-
Filesize
371B
MD54b71d63f1eaed1f3727befeee65b9e22
SHA120ed5397e86da4df37f334c739d102319711c8d7
SHA25696834bdc33bd9bbfad41a0dd7529b9e8a065cebc2644cc1beff7a68d18c4f2f9
SHA512bb4b0e265cb609129686026bc496e7fecbe966721e2a5e1f1685a7a2a5fb2640bc82c9628d67216b9aadbb492a8adf53165649aaabf47eac4899666e4ab58cee
-
Filesize
371B
MD56a1450963ac6e03d65d18cda40f1aefc
SHA1b56a8e525675755239a3c8f51506b3e26453f509
SHA25609022fa89f6e091a39d99640e6f481472306105d9363ad8257a97d815f095ed5
SHA512300216cbcc44a92b79da2d05868f96794eda31a4acffd78295406484b67d93073a28552a13a77c148cacacfdf9c91dfbee5aa7efe797ad3664c1ca0db32e7fd9
-
Filesize
371B
MD59226e46aafe90a968b4c3c72957c1ade
SHA19cb31b85e1bf2e4e53fcb3c47542f37637432a9d
SHA256567af2726f9091ed478e7e2ce066a430cc61cadb13870d0c2039ab4e089f92d8
SHA512146bf40581e545297395475e6ec21eccfa787856b36df4663a9956329105e6e479fe0527334c4cacd9e354ed81e402875ae1fb7c918dd6261af62a5b206402a7
-
Filesize
371B
MD5dd138239fe16430f944f85957088ac15
SHA1b1170c804bfee9e26060188447d4feca785b1b81
SHA2562a8bd8f724a2483ee4cf7c9f35e2aef54624c393bb198b34bddb0df18cddf8f6
SHA512e4a380516df746fdc2be91519001deb5a6e9444f0702c0a35edbdc845e61f59864baf9a84e138ad7af9b4087e09bef7a545452f9aa40b6725b3aba09a217db07
-
Filesize
6KB
MD55ac4796bef50cd38c8fda9438850cc61
SHA1c346f670b6376ef1c4658955c91749f2f34f5150
SHA2562275fa032ff10c8c05401846743ad48e4f3697177c3b9c9ad0345f1f071afd9c
SHA51208a9ece8d4128983f801995d6da0502f7ee6c579ea86409aeb51e007201c545b2e3ceaec1f5757878dd9bb50733f1ab849899add7b0e65ca49cb331c34255a33
-
Filesize
87KB
MD51f7417bd38c25bc3878cf8d3ccc6d80b
SHA1b3ee2effc26f9664fc606cad7fb72246cef42268
SHA25625a858190140ac1397c1a7188692bfb543bbf5e9a966968dcf69e6eef0611b89
SHA51225402872491b87a9da168e931ff6b91ffc0aa3deb4aeaf8bf65bfabcd638cc4506233b0e596c111db4c3c199ee14da1c59d4e9bd621aeb17d15e261779058349
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd