Analysis
-
max time kernel
80s -
max time network
84s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2023 10:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cintas.na1.adobesign.com/public/esign?tsid=CBFCIBAA3AAABLblqZhAFHeBe_maMcDuwMRxlddxCUyYaC9Hnlka1Z0CgbyIf0cDYGX-4LE75d6_6rAkUkguXkvdxUSHUfKcsJNChUlHY&
Resource
win10v2004-20230703-en
General
-
Target
https://cintas.na1.adobesign.com/public/esign?tsid=CBFCIBAA3AAABLblqZhAFHeBe_maMcDuwMRxlddxCUyYaC9Hnlka1Z0CgbyIf0cDYGX-4LE75d6_6rAkUkguXkvdxUSHUfKcsJNChUlHY&
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133377785570837960" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1588 chrome.exe 1588 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe Token: SeShutdownPrivilege 1588 chrome.exe Token: SeCreatePagefilePrivilege 1588 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe 1588 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1588 wrote to memory of 4364 1588 chrome.exe 82 PID 1588 wrote to memory of 4364 1588 chrome.exe 82 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 2608 1588 chrome.exe 85 PID 1588 wrote to memory of 1960 1588 chrome.exe 84 PID 1588 wrote to memory of 1960 1588 chrome.exe 84 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86 PID 1588 wrote to memory of 5036 1588 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cintas.na1.adobesign.com/public/esign?tsid=CBFCIBAA3AAABLblqZhAFHeBe_maMcDuwMRxlddxCUyYaC9Hnlka1Z0CgbyIf0cDYGX-4LE75d6_6rAkUkguXkvdxUSHUfKcsJNChUlHY&1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3ecf9758,0x7ffd3ecf9768,0x7ffd3ecf97782⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1876,i,7849166342514261501,7706795778491124535,131072 /prefetch:82⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1876,i,7849166342514261501,7706795778491124535,131072 /prefetch:22⤵PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1876,i,7849166342514261501,7706795778491124535,131072 /prefetch:82⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2744 --field-trial-handle=1876,i,7849166342514261501,7706795778491124535,131072 /prefetch:12⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2736 --field-trial-handle=1876,i,7849166342514261501,7706795778491124535,131072 /prefetch:12⤵PID:4220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1876,i,7849166342514261501,7706795778491124535,131072 /prefetch:82⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1876,i,7849166342514261501,7706795778491124535,131072 /prefetch:82⤵PID:1016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5048 --field-trial-handle=1876,i,7849166342514261501,7706795778491124535,131072 /prefetch:12⤵PID:3108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3128 --field-trial-handle=1876,i,7849166342514261501,7706795778491124535,131072 /prefetch:82⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2700
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456B
MD5b4450f0333033deceabf5658e5037130
SHA173937bea5007f445eeaba8717872480b8098159c
SHA25660865b675950c4d042f9bf8d96fbf423835cc663e2a2d5069b2bfd070cdae4aa
SHA5120b0a520c39061d455a83c143c8bf10bc8ba02b7b03f0b20355feffefad6fe767081c19c0415ec9ffd5c44ac7e1be194009c640046cb2bff8aacdf8541e84be82
-
Filesize
312B
MD57596395e8b4895b30949a0e83c288c66
SHA1da9b935960deb011f55a4a5eb2c5b0d34493bed5
SHA256019ffc3c3426d762f5bc7fdf0d9aa7692f947c58c186f0b2c1bea0859551f965
SHA51223f3b2daf8675e7b2c2974d337fa1727465162f584bfc1a4283ca94dec075ecdf36db84cf04dd3a98c91c399655de4c2f40f4cee99a1f5769fdda5adcd2e2c4a
-
Filesize
1KB
MD588f7dd77c91c11f05f1726c45cec02b4
SHA1c41ccf1f6afb7ff28b5b46d00fa41628425bc9f2
SHA256e845ca2e635960ee6d8a8d82b342f4eb775b0c9247cfdc5ad78ca74702b75916
SHA5125eb33a63c0e4d978a8597f32754441de5eb6b7386ef60680279b5820ee56f8042c4166dbb5a38c7f97138e516b880fb962bcdddc57cd6d72d33092c8495c4c96
-
Filesize
1KB
MD53d3a9a71fa22a883a55710c0586964a3
SHA1d80972909c5cbfa613bad0edafb8cda1c4559783
SHA25621cf119e106b30299bb35bc84ecd53cc475da8f526df2d119b98a1d01a8ffec1
SHA5121da2b5171132cfb2a187c1d17a0383f9e4dbe18bd127017aa53491e9295079256277e82091c4d57f3dfed25382107628ec738a7d9f7e98277424a9a6506a9334
-
Filesize
1KB
MD501f8165547f6e9540edcab5b0f5eb2b5
SHA1c8c94a2e38df88e1d0ef8f5f9bae2865401fc231
SHA25652c55a7a1cd06055ac931ad531e632de6110f7904f105f4f96dc1c1af7f40d7e
SHA5127ca87d958e42eb1b2beb6989e23142621ef1842380c4a60dba90f391417f9bd394c7e402b1a4c924caadd17aabb237d1c5b4823bd3582348aae18129dfd0845a
-
Filesize
2KB
MD5eea4f02ecc2c9fc562a64a4519e57f89
SHA1efd045cef49f6f7bf0c8c22961e785e25140d6a4
SHA2560fb721b95f38d0a90378e65b8a8c70322077572aeedcf8bc6c49084624ab3b6f
SHA512fa08726ec9c3fca0f17a3b9b0d8957ce9b0ffdab660ed95e2fa92c7f7022625c2199ce2d730c586b87f4179e1408ceb64a96fd3914dd26891bf9a4dc785d9af3
-
Filesize
6KB
MD573382810529b6bfda759df9e14ba1a8b
SHA1c2059cac28884945c070ba10f1eb820a333a59ed
SHA256dd848f7b5e98a3b6cbb35333c875060b807e6a6a75cf56756f0a498f4ba8e6df
SHA512915e28eb5312b46cbc1918d194236749179fdf2781d2a4039d1eb44dc7facb22b16bbe9b5e3c9131ec32ab2c7c605f8cd864e17916238880d3a7e3047321bf50
-
Filesize
6KB
MD5f7fbb5662c87210c701dcb2523bd6d31
SHA1b2c4dfe738a750103b208bd5a60ce1553d8f3cd0
SHA256f1958192316f3a065050b93187aa7470b8e86e94b1422ee357826f785ae5198e
SHA5120bfa51155af47f802b7fcf8daa8553d1e1a4d72214f52e3bf6687f6c78352340f9a134218ce9cce01d97cfeaa8452b53e1810a4fc689d98731890ddf9f01ada9
-
Filesize
87KB
MD5d026000d7c9cd072109d7d83f93ade66
SHA1ce2566c726a3632367418c1d7173b32c2fc9fdd4
SHA256e8aae90dd2c999372d079dfe1f7c3c66fc768ac63335970d5f0e5b1cfdf25c3b
SHA512c608d6a95e7d47ab8838c4824a21f1c389eb45173a85a9a0e9895d02c695aa260b70ec81ff4fb07c8a002543a3076f6a37068cd63b55bd2735541da710c61cd5
-
Filesize
98KB
MD5487bc9149b435222ce97064ed66c9943
SHA1437fa50672ade207f76e53d880c9ee9c232b26c3
SHA256623109d9b96b4e2528ef0d3ac290faf16d6917039ca06470b19a63ef1dd682a5
SHA512e8990ff1ceb44729150e78772ece6bd3b6e5881fceca4d60b68f8dc2c10496678149e9e0d34df45f54a92823233faf21f5196fd739fc2364ef996fc9a2036d40
-
Filesize
97KB
MD58fbbc63e01b04eae634b3176a206fffc
SHA146c4dd1c8f0163d1451d80d751521681959ac395
SHA2566957462344d5457ffaef3c8256e3f3ea627f0257f9c5d193f87cce33b3ca4865
SHA5123608675b886bd4b6cbe495c68913bf78730333d9b65c7f2ae7b05c81c3b4d779bff8a755437330db60541d48a9906dfc12df06085d5c588199bbf49ff0fee6bc
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd