Analysis
-
max time kernel
85s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21-08-2023 23:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://fed-taxation.info/verify1
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
300 seconds
General
-
Target
https://fed-taxation.info/verify1
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133371324647876960" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5112 chrome.exe 5112 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5112 chrome.exe 5112 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 1316 5112 chrome.exe 75 PID 5112 wrote to memory of 1316 5112 chrome.exe 75 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4304 5112 chrome.exe 83 PID 5112 wrote to memory of 4540 5112 chrome.exe 84 PID 5112 wrote to memory of 4540 5112 chrome.exe 84 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85 PID 5112 wrote to memory of 4320 5112 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fed-taxation.info/verify11⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d17b9758,0x7ff8d17b9768,0x7ff8d17b97782⤵PID:1316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1848,i,14809168295952066694,17807930431035755613,131072 /prefetch:22⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1848,i,14809168295952066694,17807930431035755613,131072 /prefetch:82⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1848,i,14809168295952066694,17807930431035755613,131072 /prefetch:82⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1848,i,14809168295952066694,17807930431035755613,131072 /prefetch:12⤵PID:4064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1848,i,14809168295952066694,17807930431035755613,131072 /prefetch:12⤵PID:2696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1848,i,14809168295952066694,17807930431035755613,131072 /prefetch:82⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 --field-trial-handle=1848,i,14809168295952066694,17807930431035755613,131072 /prefetch:82⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2928
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\82c466cd-8546-411e-af4e-8c1f4b9e458a.tmp
Filesize6KB
MD50c3811c1508ba1763ece1e475b336de9
SHA1c0b6fc86ab2cb89e29a46254acb07749c6f78720
SHA256e372c24ad42ebf1b3f48dfcbf1f0c4a9558b156a82005e8b3c60f616bbcb592e
SHA512ec8ec960f5e590a3dc59929338297a059bb84a0126dc17d3de6c717e03d65faee96e37b5d1c9bce16cc133530bbb3390673984155805e0e5bfca6da45fe9b94d
-
Filesize
72B
MD50e5a591528587de16d19ac7253b274a0
SHA1eee2a00c89d6f8f0838f0a936d25ca1aa45b9915
SHA25674070f57d3734d9a863f7ce20d09f5f000e9010adde6772a954f66530bad9d53
SHA512f46b03d179afc7d582e5d31067f10fbffcd401b4580581a626dcdeccea6de1b23b7f245b206ae78146bff890a02f6b7ac004b490dd06bac19b7028ea97489bca
-
Filesize
1KB
MD595811dc3a83da370e0938104d8f844e9
SHA18aacdb08ef59f1b70d4e89c79161b06ed6466cd4
SHA256152d7642529e0af2473c18f4e1262084c45ab399f5504e5b469493a98009f18b
SHA51282f09d68d3500a0b796e3b0f92b6c8bef3449850555bdacfd30165ff714cc6b5d5bb4161898e95a373ec3c528bc936e4b9f695b133c58eadf37ab6a1fb69b6d6
-
Filesize
537B
MD524e860c233fc086bedf4b7af890eedf2
SHA1c42138a6c1827090651dd0be62cd035b1284adda
SHA25608d65bc70617a4e182162bcfbd3b2dbd1aa770677ebf8eb6caac4f9d7a8db803
SHA51233d790a40e8aa0f2442b88db049b31a0aadd1123a2b4298b2515df8c5baefb634fad836af0bbd28e098c8e09f32801926fd98e27033b9ab0eb50890043f57afc
-
Filesize
6KB
MD5f7c88e25233683282fcbef45fd6f1f5a
SHA1cb27f969e9268257691f3e35f14adb689caff0d5
SHA2569915db8c4b3372aa145c31db85c01aaae1a0f3c4a0ebeb593ab87b02e80eb373
SHA512999d07ecff271eaa743cb31aeff5d25fffaa7f2b9c4107e1ec223f47f40c9addd169e5bc314ecfaafaeaed5e5303c39cb00a95746e3b6d2dcd1b5bcd9727195c
-
Filesize
6KB
MD5b5cc8a463043150fb501dc0960e8d8ee
SHA13b6a8051ba85ab73e7c95e89ba24c3d800a80dab
SHA256ce1e90b5b4132d22d432f0ee5a7763ff677787b54d84e1b40b03e5eba3b8b09d
SHA512d4a872f5d4b817e3903f42815c9bf5edd688a3d74b6497043bbba3d2c225e9853d2e13c9fec6e0e5757ba92d4f680bde44c21d7877ce14d624ac65c28e46a98c
-
Filesize
87KB
MD5477f3c53c393ea7e939143f4e260df0e
SHA121758f4edeefa6a6f55a0ea896703b828f3e813d
SHA2560e71e889e76dcb64fb03914f75c62867a8b5acc8d779fad5197db11ae58b9888
SHA5120762301fa0909eb7576c42a41198d1db49e4a348a7996dcef6b6a90ff33e2f92da7f6f9ebaf626426475bebe7df6ec0b0e848c7b1ca6facee2dab0fbc2e733c0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd