Analysis
-
max time kernel
81s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 03:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://y1yvm6h.bddkpjgoag.com/image/4zlpc15
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
300 seconds
General
-
Target
https://y1yvm6h.bddkpjgoag.com/image/4zlpc15
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133374941721563777" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1340 chrome.exe 1340 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 2292 1340 chrome.exe 81 PID 1340 wrote to memory of 2292 1340 chrome.exe 81 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 4204 1340 chrome.exe 83 PID 1340 wrote to memory of 224 1340 chrome.exe 85 PID 1340 wrote to memory of 224 1340 chrome.exe 85 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84 PID 1340 wrote to memory of 232 1340 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://y1yvm6h.bddkpjgoag.com/image/4zlpc151⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc84eb9758,0x7ffc84eb9768,0x7ffc84eb97782⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1872,i,12659358792644704379,2669260361769708535,131072 /prefetch:22⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1872,i,12659358792644704379,2669260361769708535,131072 /prefetch:82⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1872,i,12659358792644704379,2669260361769708535,131072 /prefetch:82⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1872,i,12659358792644704379,2669260361769708535,131072 /prefetch:12⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1872,i,12659358792644704379,2669260361769708535,131072 /prefetch:12⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4828 --field-trial-handle=1872,i,12659358792644704379,2669260361769708535,131072 /prefetch:12⤵PID:408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1872,i,12659358792644704379,2669260361769708535,131072 /prefetch:82⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2976 --field-trial-handle=1872,i,12659358792644704379,2669260361769708535,131072 /prefetch:82⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4540
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD5e05cfd778302f1802842dd1094d57459
SHA1eb9c281f9179f88d5528fcb0320c878f9abfc69b
SHA25603e18ab5abbc82c013609f697e7562faa1514e366c13e5327267e0f3675af1e8
SHA5125ececb71a19d4ee9e224b35b42e563d0f0064f79ea98c902da77ef2be40c6475524f7933aa07c9d0b0873c6a1baf740f9b7709dc55356f86730ccb358aa01674
-
Filesize
1KB
MD5128fd8dd77ebd02de99e3baf48c0b211
SHA10f9406467c0bf6588c10f45aaf376e4a8f009527
SHA256702bd559bbea563770d5b28fc4d8560d5c29fcf12e0d6c3bbd1dbb8a40ec9a64
SHA512c2f67854509496f05d8b5493c7a508a6bdceaa16961afd0473c12129162a12ae72f7274a72080daa00fa79f205955099a459ce1b7ed4104af8e5b9fbb2afeced
-
Filesize
705B
MD5ee733224fc3d4938cb675968cbb71532
SHA10d427e4a0961011fffb2533ad1e49b4840b1e729
SHA256277423868d2b0a1ef03a946c562f2658f303ab3c2da9e50b566538f9ff5763ef
SHA512049fa4d4bc481616891d067befd73f98f479badc6523607a554e775b26992d3406304ab700a313a5d31949edb3049955f05f2c1f058aa5ab1df3bda81351ca73
-
Filesize
6KB
MD52e8344e0fe0000babb851d670deb2889
SHA1b2f3d0b301da2c0335f5ceecfe1fdb5769644b79
SHA256c5319b487ff991305a7eca05578589931c41438554afe6d50a206f67d6c5a094
SHA5124c0a83da88bca96e219c28990d6d126fde95f61d043c14590a510cb62d68ec2aae45487e28843e549a52894f6d2c1b029e2a9da56fbd4686f7ea6c0cb7f601f8
-
Filesize
6KB
MD5606fd9e9953f7cdd45e3e2a03827127a
SHA1d09e8af962d8da3202a08aba25f9f57074973e19
SHA2566226bd14b9ac3e7d8f073cab4af4caf9aafd86aafdbb49e3ea95d2286e211e46
SHA512898f134e0969c6072feb4df7400a916e532f1a907fdc03bf19a7f2b1816cb6cfee9b9b9f6552676b7cf2d9091c549a6368e872899441e99f479557cb19e57703
-
Filesize
87KB
MD588d935db60d9b7a13eb2cd99284df4b8
SHA105f174def551e06a56b481d29113e92bd7f4313c
SHA2563d56935f18ef0accbb4e97db7ba1b7c64b2f40736a9139f58342d44e2f1a9d16
SHA512ce2c34e5d628f88877b9a675eac4f2f517f1134c7f7ab28d4a67f0203f616d06467783fdb8176c8274b6d050174f3ca732fc86f2346a4424cf60eabd15724eef
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd