Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 06:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://go.emtech.digital/unsubscribe/u/1002871/f9a9f806827f033766c448b8777efc6e252fd453006d708fc15622a298d89003/387077557
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://go.emtech.digital/unsubscribe/u/1002871/f9a9f806827f033766c448b8777efc6e252fd453006d708fc15622a298d89003/387077557
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133379404692062953" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe 2808 chrome.exe 2808 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 1540 5012 chrome.exe 82 PID 5012 wrote to memory of 1540 5012 chrome.exe 82 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 2636 5012 chrome.exe 84 PID 5012 wrote to memory of 1716 5012 chrome.exe 86 PID 5012 wrote to memory of 1716 5012 chrome.exe 86 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85 PID 5012 wrote to memory of 4416 5012 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go.emtech.digital/unsubscribe/u/1002871/f9a9f806827f033766c448b8777efc6e252fd453006d708fc15622a298d89003/3870775571⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc95079758,0x7ffc95079768,0x7ffc950797782⤵PID:1540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1800,i,189511478826118940,13763662365998933523,131072 /prefetch:22⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1800,i,189511478826118940,13763662365998933523,131072 /prefetch:82⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1800,i,189511478826118940,13763662365998933523,131072 /prefetch:82⤵PID:1716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1800,i,189511478826118940,13763662365998933523,131072 /prefetch:12⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1800,i,189511478826118940,13763662365998933523,131072 /prefetch:12⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1800,i,189511478826118940,13763662365998933523,131072 /prefetch:82⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 --field-trial-handle=1800,i,189511478826118940,13763662365998933523,131072 /prefetch:82⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1800,i,189511478826118940,13763662365998933523,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2808
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a28cf31f19d0869caae2e3e5ee1877b7
SHA16dd78333ae3cf9ea07fe42cc1ceaad4296033acc
SHA256feacfca6a424a7eb5c7e8f25c356a7265c2d29012070626c8a6c803e1c7d2e3a
SHA512e5a3f71a682c122faf63b5a3d2db6f410c372af278ac2ab5a89b41b020ec9333769dbf5e960a6a0c684a0387f73fe1ad4b2bf16b7acd13eba3c6c859c69207e0
-
Filesize
6KB
MD54b8d993a8a9e1cc78fb3c7fc6cffdfaf
SHA1f38ca2b725ae1323deb14e29e07526dba0ebd54b
SHA25654e7b42a314d8487f7fec8654db45a688b8ed26bd97b88478eb3d85718c1ab01
SHA51252004ed1bde7134521ab74235f78befa8e60e007e3165aac23c2f5057f8790935e557e3a54c504484f6c5cbab6875447499b97f6c99b6c0fc9d700680cb055ce
-
Filesize
87KB
MD528fc2b45627219673bf9f2af9474d596
SHA19842504eeb2a8906630bed1194188c299a4db17a
SHA256c965e389b14adad19dc112b068db3c1f5a0aba56c16f9276d182675ca765784e
SHA512157b7da5902bb738a6e584b572b2bb421c639a88b7ab605e2765dc0b7acdbb4ec576afc8d1f097044a56027b787ee824a64a6d5ce4379a77c0e97a9cf4924de4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd