Analysis
-
max time kernel
21s -
max time network
25s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2023, 15:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://myanimelist.org
Resource
win10v2004-20230703-en
General
-
Target
http://myanimelist.org
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133365860370203713" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4640 wrote to memory of 1176 4640 chrome.exe 83 PID 4640 wrote to memory of 1176 4640 chrome.exe 83 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1120 4640 chrome.exe 85 PID 4640 wrote to memory of 1520 4640 chrome.exe 86 PID 4640 wrote to memory of 1520 4640 chrome.exe 86 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87 PID 4640 wrote to memory of 2884 4640 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://myanimelist.org1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff936a59758,0x7ff936a59768,0x7ff936a597782⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:22⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:82⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:82⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:12⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:12⤵PID:740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3812 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:12⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4336 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:12⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3452 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:12⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3404 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:12⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:82⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:82⤵PID:4016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5780 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:12⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2244
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b6511d4313775a3ef90bd356dc632e3c
SHA1a1185dc8aef996a143a872564f91f042f9a98df9
SHA256c8b888fcea9adf1d9d326fc11dde7aaa02b209b92dfc879e2688f341c4707cbf
SHA512ba473ee117e45ac30a53aee6d788b33d2082342bab094d7275df04750dff5cbe1f2a0563f4914671eaa7c928b1abadf089353b949b1b4e2be82b858bb02efce7
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
4KB
MD5fb257093e5eedb84155f9b363d4fbeba
SHA1809290caf56887077d26ef137dfe552a983326c9
SHA2567a1c1f78af6181c38c712fdd42955591527d7c236856afeb0e61f5936e4cb28b
SHA512175755344daca8ef8db213599dcbd12f80a3bde4c728ab3d4684fff92942ed90ce538f402c942ffdeb0078bab4638ec2abb0fccf4a29959998aadee708534d48
-
Filesize
2KB
MD570ce500d1159a87e7fd863c709b84ee3
SHA1aa9810703cb076a45a74064ca3fc050c8301b641
SHA25698f090a56020aae62621e82c6db8fb03a60decda5fe3170f8b0d273a86b48870
SHA512b87fad61c2382e7a0a92ffb8d4000793480bb3647a407f0c4c2fd58d0dc32e00218057876712585cc2c9381bdf68a436138edbdf839a09c9730b5973f73c8d40
-
Filesize
2KB
MD50632344b231288511b46211cadf9822c
SHA10b88ec547126acef678f24618fee68ee827d835e
SHA256e61b7dc6543bc1919e3ab3e6b51082c816515b7605de62b86a0d596602693153
SHA5123522ac6693c01091641d73509169f422bd444cbe3d43a3b91f89a15b57cb7ffadf980289edee14efe44cedef908b306a8c892de3345972d80c2f0c7e46b29d1d
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
7KB
MD5f450ec77ba907669389ba14694ac9fd8
SHA1f7a7173bac63d20c3a0b38a7d2a13012b1a6a7df
SHA2563f49d97fbf137f79dbb7f8930d215558f0a01b3e269ef146ce993d3c34e08bf1
SHA51285bac67ac3777ca22b83ddb34ed6b918473eb38e46c9b677645ba8be84549112291709bc1c0f04e77b81947b096f6cd4b2871dea9568907add24a9728b912597
-
Filesize
6KB
MD55ccaefe6f6f0fb05761a51a33ca2c7f1
SHA1a3c439c596c0b0b041ac386f3e76d61eaa754d9b
SHA256d594c4a76b14eaa59acd8696d86621c0f3a0c982f819d9bbad8e0e43766ddc51
SHA5124914efa226447c7a75e22d99004bc2c30a85ce425235b11fef7e2269ce9d0841a4c87eccd8bd88f290a98b7c5ce29d10878204b81b57cc735305111aa9a10d31
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5d0968db09e8a45631e4d7ebda043c8bb
SHA1358051b2854fced817a0709315f10a0283d4e916
SHA2563deb30c36df477da849e4d549e37ff412b5893eb47cf5d8f42180c87e401f8a6
SHA512c6efcdfa0b1a163e1eaf5ec22edf26824b2278100846feb43dc93b7e5ecba315259204811895e7f002278df65934e349c92c4233ad153738c63e8f8af8f2e66d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5858c9.TMP
Filesize48B
MD51de63199b500c8acf9805abac4e2885d
SHA1d0630b6a12c49f50b561ef3d2e6a15682ad69c31
SHA256479b9ed5ac5da7b81cf42b1b20a019bfc679f52d77d8b9688e0ed4f3d432d7df
SHA5120f842e6c860aaa0db6c3a144607861d9bd96237a3d1e4d1609b82005bca17531827fdc18bbc6fb989e27b32fd8beed6b5e119d1b19472a7e49b00e6b2e4c4a41
-
Filesize
87KB
MD5e2ad2ef51fc8620a40bdf9ea04ad5c56
SHA1c3e172a0fe2fb858ac64e25a026fb8413854b4b7
SHA256c289c6fd708906490da3312c087e47ed569efc75b2e144d4618f8acf945c8a72
SHA512ae5fa1c08dd806f1b80e2fe9d61c2c769b98870e5afe3326eaae97d09183db519996c440fcfd2ba34a66785fc577e86a092c854ec2583f17f7d7432f253ae924
-
Filesize
87KB
MD50981d41fc0f39bf74a6decbd621fc900
SHA1be26cba5350dea123a59303b33654274d86c7a19
SHA256e0d90ce9b8d263fafb94fcbeff15ef2c6da7c4530a77ee89152da09191d154e1
SHA512c0745483e7d9121ff02160b071e13024407e409612889f03c3c7065c92180dcb8fb2cc898777e5f76b744013641d0a170647633447c1d50ef7c307ac3fa92c0f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd