Analysis
-
max time kernel
1200s -
max time network
1149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2023, 14:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://lapizone.store
Resource
win10v2004-20230703-en
General
-
Target
https://lapizone.store
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133359785564127510" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3956 chrome.exe 3956 chrome.exe 3228 chrome.exe 3228 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe Token: SeShutdownPrivilege 3956 chrome.exe Token: SeCreatePagefilePrivilege 3956 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe 3956 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3956 wrote to memory of 852 3956 chrome.exe 80 PID 3956 wrote to memory of 852 3956 chrome.exe 80 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 232 3956 chrome.exe 82 PID 3956 wrote to memory of 456 3956 chrome.exe 83 PID 3956 wrote to memory of 456 3956 chrome.exe 83 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84 PID 3956 wrote to memory of 3220 3956 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lapizone.store1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ddcf9758,0x7ff9ddcf9768,0x7ff9ddcf97782⤵PID:852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:22⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:82⤵PID:456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:82⤵PID:3220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:12⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:12⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4804 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:12⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4640 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:12⤵PID:3300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4040 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:12⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5400 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:12⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5560 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:12⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:82⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:82⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4712 --field-trial-handle=1840,i,2215623158039417695,11262296506105129398,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3228
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4852
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816B
MD5396379cc318db2c62936e46b90fbe03c
SHA1460a9c25379c8a672770a04917412b00d8fdf70e
SHA2562f5b63f284553e1e4a2780e506b8c5877718908d9ad5ccc71085cdcba996796a
SHA51224538184c85bdc2b29cea8715160bef8641f194f1d1b80477cf7951ecd25c4a11a3a34fa7647e244384d59136b61d65a40aa0c8995b5cd1b5fa3035c047febe4
-
Filesize
2KB
MD50374027eaf81a77fcc460ade303a9b05
SHA1c564db9945c05e209d4eba50707db75c24fcca61
SHA25678d0fbf9d8f445ac9aaf967af5aa1ea8e27a76dc4cfa3bfd4537531becc10404
SHA512139bbe2cf3a02c53f195953bd3fbce8e2b431555eae954b3db7e47f325a7a70f0a90a3f7a09c863b527c2f72b34499b75a80d4a94fef818a72d7086b59a17acf
-
Filesize
1KB
MD54e7579dc107466f19d0976f2e35549ba
SHA18a12eb024bc2b1d57a2a523c315fe9ab30be5244
SHA2568d5b66ab928e284e56ee3a999623cb59ea7703ea61d85aa3b68c6e14370596dd
SHA5126e5e43c2031aedd475a06290707b2a65f7fcd778ba2886929c548ef67856757609af22015be9af7a5a60e3ad65c84ca06a148052f38a717869873830f7f5bb69
-
Filesize
1KB
MD5d3f1a92c190e41734bf66720858436ba
SHA15a1d5ce8bd3c603bcd86d6bef129dfe3b5e1216f
SHA256ffe881d333f84607752c4e401ef3208ff989961507333613dce14d466dc68774
SHA512f6b5556890bb4e610e840f6558e26d58c55cfbc22cc057c6383e0b33a32f65ba81d78801530bdd0112ed0fcaa967ba33799f68cf771b67dcc7ee07d8927b7c7f
-
Filesize
1KB
MD58e8adbc35d4d7a38656be1c3d9a9a489
SHA182719b80196f7fef88b899d7239e87304afea4eb
SHA256795d288d9bce6b2a48b79a853635f20b9a4d7457d8eb0b4cd45e78504521e763
SHA5129595f09f240e70b6e054e25b6c2086ddc90d475467d0be71fa990ddc2068df9fa337056b0687d83dc975bbba50884c15fc06370079c7f7748c073df14072628f
-
Filesize
6KB
MD50c068ab3bc98c25ddeb0be00820c6b4e
SHA124e21adfc6aacbbba49f9c59bf11720fefa4a7b0
SHA2563d358c1ee9b0ebf147da551d34179eb3ccab4067955fc53a511fc1d0823fe8ae
SHA5126dc2412fae86e11ed49c66baf81f62b3103c300a5fa731896f71fd5f2298c814c6e800e6708632455301f4cdbaee2abdd4d5206a0a98ef92a71092a629e41c26
-
Filesize
87KB
MD5cd810ea045694ba2da2ea61cffb58e92
SHA14d054c9df67284d29ddde0c6b0065574dfff832b
SHA2561834ff46875550f575e1df1aca5201f4116cc7e7215025808f9ed9c47b6813f8
SHA5121a9a2ae3fe6291bc80e44521910e6d29fcc188c9d8b915aba7377dd95a19ed864898ceaf72b727c995b29f6ff4b08df7ba49b6799280775ed3a02d63f63cffbc
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd