Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 09:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://t.sidekickopen72.com/Cto/RJ+23284/d2pfgm04/R5R8b44K0N7-cfw72fD0PW1QtnW93GJYxRW3BPYvN1X1nP0W1GdtHQ3DHXcRW24VhCT1VpFSKW3yNpQK1V3fMnn1V3ftj4W1
Resource
win10v2004-20230703-en
General
-
Target
https://t.sidekickopen72.com/Cto/RJ+23284/d2pfgm04/R5R8b44K0N7-cfw72fD0PW1QtnW93GJYxRW3BPYvN1X1nP0W1GdtHQ3DHXcRW24VhCT1VpFSKW3yNpQK1V3fMnn1V3ftj4W1
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4468 1752 WerFault.exe 96 -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133376902580377678" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 2292 chrome.exe 2292 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 4712 1576 chrome.exe 84 PID 1576 wrote to memory of 4712 1576 chrome.exe 84 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2840 1576 chrome.exe 86 PID 1576 wrote to memory of 2724 1576 chrome.exe 87 PID 1576 wrote to memory of 2724 1576 chrome.exe 87 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88 PID 1576 wrote to memory of 1532 1576 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.sidekickopen72.com/Cto/RJ+23284/d2pfgm04/R5R8b44K0N7-cfw72fD0PW1QtnW93GJYxRW3BPYvN1X1nP0W1GdtHQ3DHXcRW24VhCT1VpFSKW3yNpQK1V3fMnn1V3ftj4W11⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf239758,0x7ffdcf239768,0x7ffdcf2397782⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:22⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:82⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:82⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:12⤵PID:3300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:12⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:82⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:82⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5008 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:12⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1748 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:12⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:82⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:82⤵PID:3876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5096 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:12⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=744 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:12⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5072 --field-trial-handle=1920,i,13400190236424222608,18100731440003287868,131072 /prefetch:12⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3056
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 1752 -ip 17521⤵PID:3668
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1752 -s 8401⤵
- Program crash
PID:4468
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD57332ef09de63a28b7458aa9592c6caa2
SHA16ff103bb428833e8e44962848945bb6d2848a273
SHA2560b608c8f4bb4ad30b63c02455b22b815196bf7aafe41d761b29c5568973eafdb
SHA51275f9a0323c319bc5129b0af21277a48735b59eed52860f18606c9da25d4a4184b81585a945c803855b13390141be7f6306b609c8e8d6e3ecc872d9b5510a85f3
-
Filesize
6KB
MD5c4718236419d03eb3cfc735509f68a7e
SHA18e6c7a78b830a879c6ea5667f9f36f25859458ba
SHA256f9e072066935d3219284c51cbc1d41ca772af7ba8fc2c343f3432e2f7fca3bc1
SHA5124858e7dc47f2fd24ffda5c0da5e486ea02d122a52bc7872608a6377399afc5a5fcd61f6f5d5dee6a75be747945f5208d978a7d0993cedf196d8b472a90d9cf8a
-
Filesize
88KB
MD57da82fec7978b547876098d48997faf5
SHA1cdef1c67c2e5adaa1883434e56f0cd20d497af8e
SHA256ee748306e0053c2a8fee25e652e7dfb3d2ecefc56d28e65eae64b08bbb94cd0f
SHA512db09072eba55d8d30be1f3b0dbd103147007949d2af6bd479ea690e30cf9b5cd0622778672fc53e1358bd3eac8c1eefa0ad2ba065d1a39a5ac122ca3e74b8120
-
Filesize
89KB
MD59b91be6ca23a8ee0abd5997cfd9a9ebe
SHA103102e717298b11a119097bc9ecac8bd5b6a1fbe
SHA2563770605c600bab727f5aa638f1c7860e4529f97de1a1ec8797f509f3c2be13bc
SHA512686bafd54216cf94ea71cfc07983549033676cfcfa2099418415d4fbc7c1e84aa50b60af48de2d69c31545ff6bb17a07b108cd71fe1ebf6031fb22a20fcbdb27
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd