Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28-08-2023 11:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.ac-and-o.com/download/catalogue-formation-2024/
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
https://www.ac-and-o.com/download/catalogue-formation-2024/
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133376948798608056" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2160 chrome.exe 2160 chrome.exe 3556 chrome.exe 3556 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2160 chrome.exe 2160 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe Token: SeShutdownPrivilege 2160 chrome.exe Token: SeCreatePagefilePrivilege 2160 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 4004 2160 chrome.exe 81 PID 2160 wrote to memory of 4004 2160 chrome.exe 81 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 5040 2160 chrome.exe 83 PID 2160 wrote to memory of 2688 2160 chrome.exe 84 PID 2160 wrote to memory of 2688 2160 chrome.exe 84 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85 PID 2160 wrote to memory of 1640 2160 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.ac-and-o.com/download/catalogue-formation-2024/1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa46a89758,0x7ffa46a89768,0x7ffa46a897782⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1880,i,9299288399401481810,12074495588204652150,131072 /prefetch:22⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1880,i,9299288399401481810,12074495588204652150,131072 /prefetch:82⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1880,i,9299288399401481810,12074495588204652150,131072 /prefetch:82⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1880,i,9299288399401481810,12074495588204652150,131072 /prefetch:12⤵PID:4016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1880,i,9299288399401481810,12074495588204652150,131072 /prefetch:12⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1880,i,9299288399401481810,12074495588204652150,131072 /prefetch:82⤵PID:804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1880,i,9299288399401481810,12074495588204652150,131072 /prefetch:82⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3728 --field-trial-handle=1880,i,9299288399401481810,12074495588204652150,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3556
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4736
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
744B
MD5484d5331bbb12bb54bce399e5b00b1f8
SHA1bf12de4c92e9fbc1097d3a107cecb81ad85bf73d
SHA256a322c35908bd332e9d63164f56ad1439cf5312a98519137df41129801a22cd5a
SHA512a4fc4169c6bd029efdc01f30a166b7e3f3a184058f72af04dc7cc8357fc6242c094e67bc95af99de31e47f978e64b0c443e19e79f665e35d2e697820b34800a2
-
Filesize
1KB
MD591a5f3e47500bfc75b4157e9ad6bf9b5
SHA122551ed6cd3cd6d7c7fb8789b69a0b58b6f829ef
SHA256027db6c459d4069681c8608ad3c1f38b1d4c8a0091ad6aa204dfb7c2700fb629
SHA512a25728a2be8c8638672a4436bcfa871d81300d052f1d8cd22d33569f3c206d1fdc003fb7e4fbda22b0250ad849e5a2fcfb38cc279db7d212ba5275f5f3d49a40
-
Filesize
371B
MD5619f718572f94d1bd6227ba9e731f806
SHA1d43dfdd1b5973f837e5d7e22648fdf35f7879c20
SHA2563a2ebcb2b7dbc3337fd4fe7b4a97f222abcae8d201c6fd1db33d76f23b463950
SHA5120ccd2e1d6e789fd629d6307e44da333f7fb1ebf631e4b4daa61ef67d6b04d57339922d61d55ad3456dd9c264775c608591ae67ec2b5ac038f36d0e8840e0ef33
-
Filesize
6KB
MD5c8a64566c891421c5e68ad83c9c813df
SHA115b843ddeb756b74236cae9245d0bbc5ff016693
SHA2561def01798a65451cb5d110f260efaea34a43d1b5821590713eee54c52d32935a
SHA512723ec7c8bc241e0adddd20564b8779d94360f517006d2b61d2ed7027f3ad0fc3039aeddd55782dfd79a36aa72288ed96dada9aa0d0c3467a39c7a0e47cbb7f64
-
Filesize
87KB
MD54654e9c1c329028623e350ed1c47dded
SHA194f69337217ab74df722c0cdbeb10b5894d51f5d
SHA256d50c01a6cf13084bddf8bbd0ed7df54133eca16354c6b4a5d9761c09268fa52b
SHA512e8a997f882989fa3b4349c854f7cc49b36bc9ce5cd2e7fd578d9329ef50e3956c990b4338d2ce0952b6cdb9a7084ad73ab50e0ed26caeaee78bb2fc36763765a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd