Analysis
-
max time kernel
300s -
max time network
303s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2023 23:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://secure-westpac-portal.com
Resource
win10v2004-20230703-en
General
-
Target
http://secure-westpac-portal.com
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133370467303923520" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2748 chrome.exe 2748 chrome.exe 3220 chrome.exe 3220 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 560 2748 chrome.exe 80 PID 2748 wrote to memory of 560 2748 chrome.exe 80 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4360 2748 chrome.exe 82 PID 2748 wrote to memory of 4168 2748 chrome.exe 83 PID 2748 wrote to memory of 4168 2748 chrome.exe 83 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84 PID 2748 wrote to memory of 4668 2748 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://secure-westpac-portal.com1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff375d9758,0x7fff375d9768,0x7fff375d97782⤵PID:560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1912,i,6474754121521820274,16631778130588755930,131072 /prefetch:22⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1912,i,6474754121521820274,16631778130588755930,131072 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1912,i,6474754121521820274,16631778130588755930,131072 /prefetch:82⤵PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2764 --field-trial-handle=1912,i,6474754121521820274,16631778130588755930,131072 /prefetch:12⤵PID:3300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2756 --field-trial-handle=1912,i,6474754121521820274,16631778130588755930,131072 /prefetch:12⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4420 --field-trial-handle=1912,i,6474754121521820274,16631778130588755930,131072 /prefetch:12⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1912,i,6474754121521820274,16631778130588755930,131072 /prefetch:82⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1912,i,6474754121521820274,16631778130588755930,131072 /prefetch:82⤵PID:2496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3836 --field-trial-handle=1912,i,6474754121521820274,16631778130588755930,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4548
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181KB
MD54c75aa07dd23352ee1225b5a64cc6b59
SHA1387c73c282f9b15d8f62b2c9d830945772c88c7a
SHA256edeab1e3b20750bb1c0d394b111109c0c7ab74d34117d16ee1487cc1cb8c23fc
SHA512a0e185b33114a19e6ace4b7f6af1983c45b124ecf4ce82f92ff832ad9a57ae895798ccd4473a46b9fd530831482b3ec3dc729b10c2c85095a54a6834c563d86f
-
Filesize
120B
MD5b3b1470f58054f1dbacf1d56c16d0222
SHA11d7e60a190871ce375442df20558e99c60862a36
SHA256151c16a9135a1445d117efd4592b794bf2d7f1adcdbdec438d975a4a68865587
SHA512619abb5482349200a94afac5242199a72108a2a51016acbc25bfdd526b41271687b037418288a44cc859a3018a2c207cf02b432933684dbc41e0709697d803f0
-
Filesize
192B
MD551e0881345857733421b5c414a150f67
SHA1574e4cf294adee5c81b426df0c5be5716f58b1f4
SHA2566895be02fbf37bfeeefc54837be3516dc3f4d1e5785ee3560fe47484a864ef3b
SHA512a8fd5f8b67d84239fb6889e2a745a2dfd8212eb8233836c7ddef55377d5610ce1884264acce98cd06d60829c019c8b50e1884c9510cd8096cdf2a4100e1d118d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\773d20e9-042a-47a2-8264-bee81a1a00ef.tmp
Filesize2KB
MD5c91594640fab23f394d4397b7a69b020
SHA1c756193cdae1f495f6a8db08ee7cbf3e83ca377c
SHA256f9498d3a62cf3981d623924e5c04568555bba7eb762ab13eed323d5704d42fa6
SHA512b1dadd3c032310e8e21bd0ff4724e71f500d108ffb6d024cd9d3733fdc280a7a8380d834fd926f8ff3846c45efd924d2f1a10ccd022025ff5addebc20459f527
-
Filesize
2KB
MD52836258486825705176125429ef650b7
SHA146a0e375501d42d74c7281412c176ed6c32ff196
SHA2560949dc4c957a9dff06fe4453e246ebf4bdb09151dc0f6914ef248490f2133f13
SHA512bb8450a5387c621b9ff14f807201f34d796f6310a04923074692a093597c4e05dff843293e940205f573a9b47ae28295558a15e5ff7ccf1bbbafab2813c1a59f
-
Filesize
1KB
MD5f6ea8fa797936446b4ac0e7e9a46afbc
SHA171f6cadb3b5a26a2972c9b27a42f66fb118b90b6
SHA2568e39f0256d3b8373c216d05b67e81d1a2b9c9ef4933822f72adf97875895a597
SHA5123d571dceb8fb24b22628f964425539f815c3483b2dabd5a8d9d9129cd78ce7d66e8cf64ca63779988201a61c2955bf4f7f32f4e498d568a6c8f56d9041292847
-
Filesize
539B
MD5378193d85031c64f9e5edc25e46e7a15
SHA1aaab30e5c15020917ec4790455ff72af8026b759
SHA256a0788dd5ab68ae87e21bdbf2053d792a5c6a10fd85bad345af5948ff71d9cda5
SHA512f569ba7c2a113a1ed84a9f9adf4961244653672ca5fd46cbd8bb6a5493ab71e5328e38e5634c10826e5fd4b1ef53d2d6320048e1288612128b61b362e0364465
-
Filesize
6KB
MD5bdebe8c7decb4f5d38f7417ad89db124
SHA142b6a437f61949d0cd85bbccaf4ef36c51c49fa5
SHA256728e59d8c2fe0bf81b477c241597b8289d6d4b180d3c60edd48be2fed173f97d
SHA512d9823c1fa9eb01ed422fe6de8a4aad2b6cfb6b0cdb718d74c438f106d892da72eff5f1c5586cd2278265f8efd105af9e7696eb017d78f7c2e85fc0a7d769f8a8
-
Filesize
6KB
MD5c312b1d86a0e8239b31b2c8560e038b0
SHA1fb864944e65c8d1a2ef04add8a8e32045c2d3b1d
SHA25651a2d38f0efc849293942d57f332729350320d33387c3365f2cd534d31161bac
SHA512289b7feaa702143b5b53619e1bc4948964dba35ead46c52fdd449a964aff59e7a7ffc7c82030b89a6dc222fdf03f5fb12ca4a9b357d59893fc1985d5be059b3a
-
Filesize
6KB
MD5d04b631f83fce66615fce855839fcb2f
SHA123bda7c43fcbc24eb46e01c73ec65cc896600dce
SHA256a55772f215129744066e3edae08c16e4941a1d0ec008a6fa8a9699ca5122ce02
SHA5122d4f3c0b1c925ac84e28679b42dfe6f7b4c89eb87f8512223f98d58f64935c9c30151ccd69f94b3fde5494605ab4c977377bbc800602ad5c52b05712e6478974
-
Filesize
87KB
MD565e8f2cb6c0857aeb0fa03287f19313c
SHA1a21644cbb56a782055527ab0bfbdb14cf42c18f1
SHA2563a39b2bad8fc7e902fc08bf9cd92d9735e5b953e200f078525045300f55baa42
SHA512e3c083a8ba3f780f2186fa4c8768aded28cf6d157cfa29d86cf6aac6abfc27f2d18802018b6733508e24931be60efb55ac2e3bbe7edc6a5a41bb842f2ca187be
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd