Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2023 00:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.hera.org.nz/event/defects-in-modern-welding-sept-23/#1563309554764-feaba061-58b5
Resource
win10v2004-20230703-en
General
-
Target
https://www.hera.org.nz/event/defects-in-modern-welding-sept-23/#1563309554764-feaba061-58b5
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133367929535908587" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe 1768 chrome.exe 1768 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 1408 2396 chrome.exe 81 PID 2396 wrote to memory of 1408 2396 chrome.exe 81 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 3860 2396 chrome.exe 83 PID 2396 wrote to memory of 4428 2396 chrome.exe 84 PID 2396 wrote to memory of 4428 2396 chrome.exe 84 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85 PID 2396 wrote to memory of 4524 2396 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.hera.org.nz/event/defects-in-modern-welding-sept-23/#1563309554764-feaba061-58b51⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfff89758,0x7ffcfff89768,0x7ffcfff897782⤵PID:1408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1804,i,17754011435302836560,15837395309857230815,131072 /prefetch:22⤵PID:3860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1804,i,17754011435302836560,15837395309857230815,131072 /prefetch:82⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1804,i,17754011435302836560,15837395309857230815,131072 /prefetch:82⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3260 --field-trial-handle=1804,i,17754011435302836560,15837395309857230815,131072 /prefetch:12⤵PID:1576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3232 --field-trial-handle=1804,i,17754011435302836560,15837395309857230815,131072 /prefetch:12⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 --field-trial-handle=1804,i,17754011435302836560,15837395309857230815,131072 /prefetch:82⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1804,i,17754011435302836560,15837395309857230815,131072 /prefetch:82⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4960 --field-trial-handle=1804,i,17754011435302836560,15837395309857230815,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1768
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1760
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5683a5f7c77807233fc00ad55196efd62
SHA1a6ebf6c0d82e5c447ed201031c5e4e8e28b85f33
SHA256fddb9e9fcfe285229b86cc094226eb0b0a1240ec0393cdff464a5166dda442eb
SHA5127d9049cccfaec73dff1cd24dcf67c992f6315cf4f2b1f5a7643c6d9b86a0368e539386ccb421aa84bd3792bf759a3837624143e7df51f2e07b2766820ccfbb79
-
Filesize
2KB
MD58cda77ce18e57b29eb356afbc7920d74
SHA1a3d0c73eb715a6301d2ab2d19e166e9ef498d734
SHA25607e29c58dd65ddd109e925ff669e7e38712f9add74d06f967acb787d30c9b890
SHA512243d6bc7238a263d16fa572a7550d09b3ffe7db56bca33d3c25a5434cf91e8d63629f315797086acc5baf771d24dc862ce2767d26050064767ad04585723a3e3
-
Filesize
1KB
MD5208dfcf29256562ec52b371444dc96cd
SHA187e00f5efd7770e88be0c7656caf88dcb43c4b02
SHA256f7d1a511032ea8d617930b94ceb7926e80d595ad11d1b033e15b37324adc8057
SHA512a2e3eb5d6e55df16e2b37e713a6ee21526ce15b0ba852cda21c677002981b79bc4f341b70ed5fc5da92c6337c784687da5767107e34e28c6ce3c37fe57af488b
-
Filesize
1KB
MD509426357e1bb1f10856495e0b26a5760
SHA11f99845cbfe4e7c1959c25687677b005b47db53a
SHA2561ec512e77ca6e7caf399315401a01d74856f559f019cf0ceb3671522f89fa5a8
SHA51257862a754ea15d7d30ad7e40726f1ab59f39bf3213aace6bed6233fc73995e71e68b23c126ac9fd3ec6532eaa2f80fd6ac226ebf1319dce37dde39825eb37738
-
Filesize
1KB
MD5f57141d8e4d068b5fb7bd4685cb8fcf9
SHA1dac2f796b04010bd0a61ad2df002d7a553c55fa3
SHA25625e57496b0aafa6c923f77c29f905b6615070b5942a711f9091f359352e8ddcb
SHA5125999a3bac4da48ddb930b121f7ddaade216f56d3ec45fea21d770e0d263c2fe4253554a935e4987ebade85784a2b822370b98cdf427bcd85ff523a746664e740
-
Filesize
1KB
MD5c19de64d5e7c8f88edc487c505d138b8
SHA14ad9daead73893361a05a497509080ae27712c4d
SHA2565e1939685167974abc3cd7e3e7c2e0b92f3f19f4e5891318bb361718e107a06d
SHA5127f231a4ec8036f76286362330bdcc9f0528ce0709ea6a87d0762958ed4f7baf249b7bf6b407a99e129f648f67bf72471a6d607cfce2eab6efe758b6ef6963235
-
Filesize
6KB
MD5acdf416a7a0ce08b4f6f9d56a5b11382
SHA184c2ac24fe54f5e85c949fb08702fd4ba7ea177b
SHA256e55fe5d0af5d12177fdefa32b10f4b31ab93756bba190b6b7dfc065310dc6249
SHA512284b58a18a8ee4ee9646f6e09060315c1f5b00d1424cb8feea70cb91ae315a11fe920801048ff07bd61287e954a88378c927c41ce49116c693110715bf492701
-
Filesize
5KB
MD5203da633e56feafc32a86999b206fbdf
SHA1333ff74e5dc206babd1832b8ec8c9e2fcbad6c8b
SHA2567d6c68e0c66d488e1c39dce31479135aad0ef0ad43e5a825f069569158c8dd68
SHA5127accc0c3c373b6aa5f5212fb33c8e80aebd10327a53c1ffa49024dcdb0c9e6d7988409bed8d8f89cdc0534c815c616822b8782843b1cb466c7d0639eaa8d4376
-
Filesize
5KB
MD5058782f58a0ee58eab6576ba1102c1df
SHA1feb573bb4a21a4f2fd4231413aafb57550abcb50
SHA256b5e087b3aef47fc01fc88183c193001f964edbe7223bc2fd573786f152170aa0
SHA51274e630523fd04e065bf12472e99dc37fe53284a89de65def0b0f0e4972f2938b060365d025a09fd0abc2ca4f70e964a6b04de14f7d2fdc2b8755b917a236d47d
-
Filesize
6KB
MD57f7d101971a28e09d1c864cf771ad04c
SHA12cfb4ec1af116a10d20759ad429ff39ac1f5feb8
SHA256b52c98b0b4eb0744eaa40b61e982ec3f177df027c93f048acba3c76ec2cdb8aa
SHA51204f4b9953889fdc806e39bcd15a54b1ec3405ea9e1409d937cf1d09119b8771e3b5d05c7f4336ebc7c702a23b2ebf6012b1dc216ff05f4eae4f1e87d68461d8c
-
Filesize
87KB
MD546d3c3bc774bb031d3306a80805907a4
SHA15e60d70f9d2484df644bdd8805d7ba640068d24e
SHA25601613bb400ea6d83b9c02346f5d2ac10fd8dc02e3e925bf18c282615daa13b92
SHA5127ae2a6307f339387940d8ff5e69af29318fc8846aaf73992d7ac446ab6c22ac772ceacc7a74a41a9a2ef4b76452404427eaecf2e14c104a937522603af89d673
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd