Analysis
-
max time kernel
34s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-es -
resource tags
arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
07/08/2023, 18:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://1.gprlrsmd.ru/fg6h56efw/hg6j56wer.html
Resource
win10v2004-20230703-es
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
https://1.gprlrsmd.ru/fg6h56efw/hg6j56wer.html
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133359050072408107" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3780 chrome.exe 3780 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe Token: SeShutdownPrivilege 3780 chrome.exe Token: SeCreatePagefilePrivilege 3780 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe 3780 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3780 wrote to memory of 4220 3780 chrome.exe 82 PID 3780 wrote to memory of 4220 3780 chrome.exe 82 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 2136 3780 chrome.exe 84 PID 3780 wrote to memory of 4000 3780 chrome.exe 85 PID 3780 wrote to memory of 4000 3780 chrome.exe 85 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86 PID 3780 wrote to memory of 2512 3780 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://1.gprlrsmd.ru/fg6h56efw/hg6j56wer.html1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff162e9758,0x7fff162e9768,0x7fff162e97782⤵PID:4220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1872,i,13458304183195133814,10510028920405066128,131072 /prefetch:22⤵PID:2136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1872,i,13458304183195133814,10510028920405066128,131072 /prefetch:82⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1872,i,13458304183195133814,10510028920405066128,131072 /prefetch:82⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2768 --field-trial-handle=1872,i,13458304183195133814,10510028920405066128,131072 /prefetch:12⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2748 --field-trial-handle=1872,i,13458304183195133814,10510028920405066128,131072 /prefetch:12⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3788 --field-trial-handle=1872,i,13458304183195133814,10510028920405066128,131072 /prefetch:12⤵PID:908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1872,i,13458304183195133814,10510028920405066128,131072 /prefetch:82⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1872,i,13458304183195133814,10510028920405066128,131072 /prefetch:82⤵PID:3276
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4212
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD53ca0dad90ced08b3c0049ef455bb929a
SHA19970820061ba8f601d88d64379174da52d40fb36
SHA256c32b8220d3e84c37ff762bbfb85212216c52b9ffd4f76244bbff5fa8aa6d8cd0
SHA512ea26f46895a902a760d39657f5132a26207fe5dc3c8dc8e14b2bf5558ed499d60d34b3ab15c5b6e57286bc1ec15c8fbe4af8990dd38f704d2f03e837f1299c08
-
Filesize
6KB
MD5a11c3b92975e7ede23ef915cab8f05fa
SHA149c7465e910db050eaed57f8e387d241593b2e45
SHA256ce4804707537e33b61b8f0a6ee9ed7b30ec26c4642f59d3d0ab7091ce15f7c0e
SHA5126c1eb86c10cc9099b3d713ff9116e115d5369624214d4c74983bd423cdc7c5cc8bd3bf4782eeb75c35af7f9d9689a84eca6e48863604f69d229e195af7a5437c
-
Filesize
87KB
MD54cf932e624517f3cb7cd3b8a875a5b94
SHA128529d18ff9e03d552f49491a8840efb1b2dfffc
SHA2562875e65100d9b33070048fa617e3744efa77dcbae1e9b2e5942e9afd8d52868e
SHA51278aaa26a37db97ccb81145940ffdcb264d212cf7fdfbbc9f27810e3064ee93874111b4806e0a365fb84d514be619a0701e8a72febbe873881d49dd4056e44bba
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd