Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 18:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.aa.com/aa/reservation/flightCheckInViewReservationsAccess.do
Resource
win10v2004-20230703-en
General
-
Target
https://www.aa.com/aa/reservation/flightCheckInViewReservationsAccess.do
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133377209967872499" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe 3356 chrome.exe 3356 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3148 wrote to memory of 4192 3148 chrome.exe 82 PID 3148 wrote to memory of 4192 3148 chrome.exe 82 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1684 3148 chrome.exe 84 PID 3148 wrote to memory of 1952 3148 chrome.exe 88 PID 3148 wrote to memory of 1952 3148 chrome.exe 88 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85 PID 3148 wrote to memory of 3696 3148 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.aa.com/aa/reservation/flightCheckInViewReservationsAccess.do1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb50529758,0x7ffb50529768,0x7ffb505297782⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1792,i,1562723224194906091,9120106957819232582,131072 /prefetch:22⤵PID:1684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1792,i,1562723224194906091,9120106957819232582,131072 /prefetch:82⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1792,i,1562723224194906091,9120106957819232582,131072 /prefetch:12⤵PID:2664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1792,i,1562723224194906091,9120106957819232582,131072 /prefetch:12⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1792,i,1562723224194906091,9120106957819232582,131072 /prefetch:82⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4856 --field-trial-handle=1792,i,1562723224194906091,9120106957819232582,131072 /prefetch:12⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5396 --field-trial-handle=1792,i,1562723224194906091,9120106957819232582,131072 /prefetch:12⤵PID:312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 --field-trial-handle=1792,i,1562723224194906091,9120106957819232582,131072 /prefetch:82⤵PID:416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 --field-trial-handle=1792,i,1562723224194906091,9120106957819232582,131072 /prefetch:82⤵PID:3220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1792,i,1562723224194906091,9120106957819232582,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3356
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1944
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53ac38ac76bca1b9e9817bfc5ea67f30e
SHA19a0c7e8f66b641862c4bac2ad961759603f9b626
SHA256334212444228b532d4e4d36712a65640c92115e56dbb06febb7c84428e344dce
SHA512ee0c25c821a17507019dea72fc1c7fbf4bf765742641f00d10d977632be0016cb8c542cba4dac0e8606afe60505ef6deb557674163b62a773632a2adedc9bc4a
-
Filesize
2KB
MD56cccf717416a3e62da35e86ab4cc2e39
SHA1a8a1d7454f25d527f91f41001216ad5a9ffbba35
SHA25675dc2c96235276669f88ed9402adade83d673dbe27cbc4ef2a7ad0e32d517fc8
SHA512a1709425e91c51f8f885c8a6e702271abb133c80a37e918249b1af7b8c329ab57a2e43753662e82435c75454cb8a89b1a3a43a3bdf0098a2b760d0bdf639817f
-
Filesize
2KB
MD5d786731210a1fddeb45c2ecb50b08418
SHA159b6874ddb5a790684d9628caba0259d8b0c5a17
SHA2564108b00d5dc1b33855106fdef6c14988d3f124051c3a45fac7369a497be86b02
SHA512e185d811f7005eecae90d0def15d1373631efc691b2e2079f21b76dbd096c673b79e34021581e454041be260b569343406d9215c44a68e30b6ab892a2089e5a5
-
Filesize
2KB
MD5bb77be029010000d8afbb6e653f217c4
SHA105084d79bafdea6060ec5f5708c279025d4b46f5
SHA2569ba912138e145be22b8abf24fb6fb97968dc617cb9dd19a44f65908c3d99de79
SHA512a375716a352faae3046af6e9e29256c9bc92ebf937e1729e1d369c1f73c11a84ceb694de2b1c6b9ccd29563646c4a81163c0ce6a39f5f7c23bfd0fbf60141882
-
Filesize
2KB
MD5f924a7ef4ab8f5b3edb85388ac604d88
SHA17185b3006a29a2702aabbbde28aebe8173d4fad2
SHA256d839679855a27d117f6e0b514654eb0878eeb4824c9b12aa75b1e918cd8702e2
SHA512656a909b214133993d0b408af6448b014f541fcc498603140a402861e75d8c8a292167823b7fad3b78f347eb3d3413fe06213753543ec60a7f1dbbb56398607b
-
Filesize
2KB
MD5e14379eadd356884c3003631f6285eed
SHA1f4303f30a4adf5efa0f41d63b20e90d306a8813c
SHA25661b717d857585e88b46dbcc3f1591901043501733472fed93d3cd85d460388a0
SHA512b1c561753bf9549eb7c57559db233afef011da29fcb9f1a87059095fd2becfd93c6f88635477007531544f805441c4891305dd609b066be9accb78a37b71b25b
-
Filesize
2KB
MD5ce6a7813e301809905d7adf59ebc8f4e
SHA14d184046d151b8df2077b64c320c9c2019b5c278
SHA256a359e458e885e5dff6840af4fae7f4e4290da9a96d0d2c6f4d3be1224d7558ea
SHA51264e9211613c124dabe06995c83871b8c351010b2cb353ac06fca25b0077374fcc3b2ef57eb8afc77943da11c69027cd52caa813993d65f79e43d7646f64fea78
-
Filesize
2KB
MD5e2aaa926a15f25735d2b957659613e99
SHA1fbd2e4155f9552098ce502f16c7df6501f38de3f
SHA256dad0e95fcd91efd925dd0e4b1b17dea3a08499f4af78a1aa5e4593297ffe344a
SHA512597caca292d523e5e3caedbbf754dd825f341e6d2a80c3658237e79ccfd2e33bbf706dccc241264689514f926eb755f4b7561fa69c69e01450d5909bb0c3ad86
-
Filesize
6KB
MD5836751fb9a2c9ce60373b730564f4bad
SHA156ab6ddc6c9088b78592b2744ee199cefeded1fa
SHA2560302d757c1d6704caf53c37a6c3db56fcca896e1f1060abf4c02accd8ba028f8
SHA512a079f6b49da4c1044f14c3b116f6b375b5278c40d11ad9b201b08f9f52102deca414e709fc9bf5e7c7dd5b9aaa5aeb9d0a26b7d95dc54ab87acec2de89fdf126
-
Filesize
87KB
MD5b443e5db9cbdc1e148be6a5b3614ab2f
SHA1588ff5ec89510357c01d3c7286a587d26e23ce6e
SHA2560049ac30b7696c03a70d4be6e293da09d4ed5b6f6c33ecb6212c14d5ec5cc983
SHA512cda9fd12a496498aaf8142da7c340030c8551f2af27e9278301cc3510c73b01301d9d8c65fefe83b63ca5e7222a17c5d80429b01e5d24026cd4a33b8c647d426
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd