Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 12:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://buymore.hk/shop/goods.php?id=34030
Resource
win10v2004-20230703-en
General
-
Target
https://buymore.hk/shop/goods.php?id=34030
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133373531711098696" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4136 chrome.exe 4136 chrome.exe 4804 chrome.exe 4804 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4136 wrote to memory of 2204 4136 chrome.exe 81 PID 4136 wrote to memory of 2204 4136 chrome.exe 81 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 4548 4136 chrome.exe 83 PID 4136 wrote to memory of 1348 4136 chrome.exe 84 PID 4136 wrote to memory of 1348 4136 chrome.exe 84 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85 PID 4136 wrote to memory of 4712 4136 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://buymore.hk/shop/goods.php?id=340301⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d6959758,0x7ff8d6959768,0x7ff8d69597782⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:22⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:82⤵PID:1348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:82⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:12⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:12⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4564 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:12⤵PID:444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5084 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:12⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5116 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:12⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:82⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:82⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5500 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:12⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3160 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:12⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3496 --field-trial-handle=1852,i,16486845987765328300,8570235548532978637,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4804
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4968
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432B
MD56d9a2a049063e3240e27277baee0ca17
SHA138e5593e3ae65bb99c47dd0214b7a6b10da73d0d
SHA256ffe944bb194195be16526167b5904a35e5598cd395096540ba94046e5cac4350
SHA512bcb40732a6cf9cb8ee1c373ca78746c4aef51c3212ca1730324313936cd89f3f8fcda487c9989e21138ed09ed3df725f0b069cfacdfd1561b2e9daba3bcf8898
-
Filesize
2KB
MD5f1990df2f67e705c6d8623f4f0476600
SHA1741acc063110d0b457f970ad8282d583c865c93a
SHA25666d01492904eb83e09b335517efecb86df1723cbd67500a5bff3e3e9a5df5c24
SHA5127a91892d0e91c356b67043a30626cabd50a358e72a98b239e3666f11305fc23be253a3de7a8aff7da893745af412b4266462928e6d902341fa0058e0c397870b
-
Filesize
1KB
MD5d5201cbad21c167bfd0189201528874d
SHA14d9c15bb87c4164d3148192dcd6380fa0def261d
SHA256f1657812d411e8750b98ced817e85e616751081c3f6cc556b9a390f851edee13
SHA51276aa4cf0f8fdd79ae2bda9c40825ce4048e57ba8db86c11cc923fb003b0794bf5c381ed3b141b995985a9f951b77029ede176421109f1cca1cfca69d453a60c7
-
Filesize
6KB
MD515e65f5a9c33463a7a7993bba14398f4
SHA1af1d3f9eebc1af8a0cb2ea2635c3fa8c630652c1
SHA2563e82fc3285c1fc9ccf8366887b64f5646b5712b883832ea5a7de33b911f3b20d
SHA5126d15da306d2cbc35f6bc20b802ec8320ae0fce32a71ce738b5f784d513195dae75909cc6dcb9a25a6bddede4adaf161860adb403ff89837b9775c07db2ed06df
-
Filesize
6KB
MD5efbe4610ac57eb81a665485950d7d017
SHA1383d94ba9cfd5cae5ca92cf1044c643dc55bb920
SHA256e2be252f9c7429f8db15a102f97ebe64627a9b0e0ca42e79c4aef9a03ec75f53
SHA5129246b4282356a0b4f969e23a8eaa90e6f70918948c4ad72d544310309377b6a21c3d0d4fc0238dc62b864bf2db1d6d6d98cdd7ec88373630212ced5c8ca1cd13
-
Filesize
6KB
MD50209fd4afd465c7cab3ec1fbfc2bb1ca
SHA1788f51149b7581760a214d1859c2bff9e728bbca
SHA2564401fabd730a8f17922858fe3d2f7b373f280b1d654ef531fc1897ea55e4ee6a
SHA512273801a1abfcc3cf8e7bdc41f1aa3dd77807b9af607a6287313f67c0ede1b7a84ed23ce3f35c5015918aa8cccbcc8090894b8fd2803830557e34b33d21a6ba05
-
Filesize
87KB
MD59039f76a44d256f9358b538ddfd4bcf0
SHA1c997ed9b0b477582a1695066785c12482a6eba6e
SHA2568db32ea0b60fc324e87af83550e03b2d339bc2f18d584fb9dd340f8a745a6898
SHA51241d99e302eb074a55fc9f6760ccf359b9ee9ec29daa0eac0b94fcb75b3625568e9265c839ee548659867844b9477c12969329260dd9af113d882137c845cf2a1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd