Analysis
-
max time kernel
119s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 10:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://conclusion-preview.netlify.app/mbs/microsoft-dynamics-overheid
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
http://conclusion-preview.netlify.app/mbs/microsoft-dynamics-overheid
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133373451020872229" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2416 chrome.exe 2416 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeCreatePagefilePrivilege 2416 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2248 2416 chrome.exe 66 PID 2416 wrote to memory of 2248 2416 chrome.exe 66 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 2844 2416 chrome.exe 86 PID 2416 wrote to memory of 3852 2416 chrome.exe 85 PID 2416 wrote to memory of 3852 2416 chrome.exe 85 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87 PID 2416 wrote to memory of 3600 2416 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://conclusion-preview.netlify.app/mbs/microsoft-dynamics-overheid1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb21579758,0x7ffb21579768,0x7ffb215797782⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1636,i,3872072248516287898,4733302526884579386,131072 /prefetch:82⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1636,i,3872072248516287898,4733302526884579386,131072 /prefetch:22⤵PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1636,i,3872072248516287898,4733302526884579386,131072 /prefetch:82⤵PID:3600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1636,i,3872072248516287898,4733302526884579386,131072 /prefetch:12⤵PID:1116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1636,i,3872072248516287898,4733302526884579386,131072 /prefetch:12⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4564 --field-trial-handle=1636,i,3872072248516287898,4733302526884579386,131072 /prefetch:12⤵PID:236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1636,i,3872072248516287898,4733302526884579386,131072 /prefetch:82⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1636,i,3872072248516287898,4733302526884579386,131072 /prefetch:82⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1388
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52f9cb5fbfbb79741885720bc9a11e378
SHA17a380c8f077beef0fa09a7a632dd1fdc731c3392
SHA25627eff319584363b7f6146822212ac012cc75036a6726182b2db527c64b1f9e98
SHA51230bc7c912e15ec6cdda0ed3bfb47355c9a5e9f88831c057700e6626c25fda794583c2687b7db9f4be309b90c10db0c394bab6a52764c3ac594acdeb48492128c
-
Filesize
538B
MD5d4ba0ae1107611f26656686d344c601e
SHA10d5b8944fffe29d76fbe49727c69c51cf2181c37
SHA2566ad376d9ed55e129b4ca6bd0cb0cb68a2204bf1acd33efcd4f5b7aad9fc6f6c8
SHA5124e46fa406ebfa50ab69841363b2f4937d3e34dea47991e629a8d3757a4f10925222f0224b0b10430f312b4b1de7237a793d62d90a41c9e7a2d877f9c767330df
-
Filesize
6KB
MD5a695e9969b6e5a6f3b8fb2281b8c885b
SHA1ff11e5203c07551df8a773f6a7e315e12e2cbd47
SHA2566c00586759d9e61529110799a76835cc48115e2450bad857fd539dd748050d8a
SHA51221b718259acadf33fc7fafb3e5564fc7564002652a48daa8723c09621768ab0401bbdb9e5bcacfcf9b71f7cf8f70155c3e8d1a5e3b17591b0c2f0e6f4ef47dc6
-
Filesize
87KB
MD52f328efe8b8b86b822afb2dd710ea666
SHA1d8ed2044e2c4fa2e75392219bb0ee68fde5aa47c
SHA256085fcef8824d4ab0437a60371d6e06f95df87ead8f6674a97126b2b703c51fa7
SHA5124a6b38ad65241d0ba215985395173b9239752821e56aabeccbcbe8e90d9954cdacb1e44bb3b20cd6fa61d7b6449ba187438edacdcd7196e9e4f6444781c7d9eb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd