Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2023, 06:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mytax-office.info
Resource
win10v2004-20230703-en
General
-
Target
https://mytax-office.info
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133359509830563947" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1264 chrome.exe 1264 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeCreatePagefilePrivilege 1524 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe 1524 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 4472 1524 chrome.exe 81 PID 1524 wrote to memory of 4472 1524 chrome.exe 81 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 4992 1524 chrome.exe 83 PID 1524 wrote to memory of 1200 1524 chrome.exe 85 PID 1524 wrote to memory of 1200 1524 chrome.exe 85 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84 PID 1524 wrote to memory of 1876 1524 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mytax-office.info1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffe40c59758,0x7ffe40c59768,0x7ffe40c597782⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:22⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:82⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:82⤵PID:1200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:12⤵PID:3528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:12⤵PID:1212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:82⤵PID:504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:82⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4548 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:12⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3408 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:12⤵PID:1908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:82⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:82⤵PID:3572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3728 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:12⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4832 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:12⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 --field-trial-handle=1884,i,4576784244004365474,18106015927926740438,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1264
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2484
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824B
MD5a94ce0351d336990c04b2e9128e64609
SHA14e31345f422713b9a450b74d64cb8700623b49b1
SHA256b0dda2f3b9930d85e75dc355c61d37c747692ee323f1bf601ce4f3c4ce8f73cb
SHA512a51c2cab05adfa9d50040fb529962c74a5cb5782a6dc9e30c1174ee9d8ec28ea85488f4f923d538132185b191e7dc3464242eef5301c1291fa04399ef8fa0248
-
Filesize
6KB
MD5c31167fc02566f65baf7948e7d303301
SHA123d082e311dad17328b973262ad3c2ff48f9d421
SHA256e31096ebc94be1c8bc17a684d935922d84c0ae10eeb08947e97095c952f54d19
SHA5127b5cc1fe29500adcaea284823a7bba68606e23f8f09fc2bde5145abffd2402f61bccc83001b292120d30b85b76567ae1c2fb32c68b4c1f3d8c5b47564886bab9
-
Filesize
6KB
MD55624fb5d3804a688099fd76ebf21b37d
SHA147ae6443bd5d09c153fb717e6aaef2ee5eb3f98e
SHA25688868070684480f314fc652628af15831ae0e64edd14c11932a56cf623933956
SHA5124de3a6ab942910f8ab27441f0deaf95c8769abda2041802f3ad59cb7984b63fd3c17d47fea087d91169314f73ee47079221471586e244db45fdd00303d93b62e
-
Filesize
112KB
MD538842b96f5f70d9e3695f130499c9941
SHA16f0686c6eeb6c737e78bccbc7acb742e5f1364ba
SHA256c75ac75423e5dcac2da30ab2dc90ed0b402630e7b4836f8415e74457c93b48a1
SHA512488e77002b9ddc0fbc02214e4effd29dae3944c29ce5aa92ef697539e4e7bb723e6af50091088fb23bde6aaa1b08b13a6ae9014df0ae414e453e38ea6c265fc5
-
Filesize
89KB
MD5eb52c8c9f2f0f29677447a1b6f047fa3
SHA180c1eb0d4e5b017196b4d80f0db4d42ab5d857d1
SHA256aaedea2f4200f9c1e4f621d0593f136fd22089eaa3aa3641d1ab0b779641b778
SHA512e59c48be99c9076f00a04425250de5b4ddd913d8250c864a65d665ace86834a5e3af9fb3dedfde3fa36003e75d266675f41f1fb66cc3d4e3dbebc6f265a7de5e
-
Filesize
89KB
MD510e984cc5f9c0b6137187400b37e3f18
SHA11ee0c2dd273cda48f10434882dd37068b84c9fd2
SHA2566f5a81a179aaba11eed6180d349645a44fe5f5ec6db412162cda7b55870b4058
SHA512f0ebe665f81c954f9ae67b0fd2df1ea4a38968600f75cb5dbaba310dfc09cb0290636ca13312e628dca8b7a59389380252c8d5d4430733a376261d36cdae6c59
-
Filesize
89KB
MD57b18dff623fa9a4ac1f515cc200c5490
SHA1a64f9ba215940629222bd6f59d5becedc7a82416
SHA256888229c36bf43561578aaeba4d410b3c9d617967200bf40d8dcb77d4e4e23f0d
SHA512d2c9b570f9e33e9173e77da2c5cd81a52157edc66c9d0fc0ce65b6643a5714a545f7a3a697ab257fd2671b1cecf7ecfee91ef6adb32237ec84cfb852b8e1de61
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd