Analysis
-
max time kernel
36s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2023 15:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://m3info.ai/
Resource
win10v2004-20230831-en
General
-
Target
https://m3info.ai/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133381405972016106" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2474409663-2236862430-1045297337-1000\{05844669-0BC3-49E3-9E49-B5EC12AF382B} chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1564 chrome.exe 1564 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1564 wrote to memory of 1180 1564 chrome.exe 27 PID 1564 wrote to memory of 1180 1564 chrome.exe 27 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 3656 1564 chrome.exe 88 PID 1564 wrote to memory of 2340 1564 chrome.exe 87 PID 1564 wrote to memory of 2340 1564 chrome.exe 87 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89 PID 1564 wrote to memory of 1544 1564 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://m3info.ai/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd9a19758,0x7ffdd9a19768,0x7ffdd9a197782⤵PID:1180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1872,i,14588098960730765423,8018385894242771084,131072 /prefetch:82⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1872,i,14588098960730765423,8018385894242771084,131072 /prefetch:22⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1872,i,14588098960730765423,8018385894242771084,131072 /prefetch:82⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1872,i,14588098960730765423,8018385894242771084,131072 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3176 --field-trial-handle=1872,i,14588098960730765423,8018385894242771084,131072 /prefetch:12⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3980 --field-trial-handle=1872,i,14588098960730765423,8018385894242771084,131072 /prefetch:12⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1872,i,14588098960730765423,8018385894242771084,131072 /prefetch:82⤵
- Modifies registry class
PID:1320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5100 --field-trial-handle=1872,i,14588098960730765423,8018385894242771084,131072 /prefetch:82⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 --field-trial-handle=1872,i,14588098960730765423,8018385894242771084,131072 /prefetch:82⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 --field-trial-handle=1872,i,14588098960730765423,8018385894242771084,131072 /prefetch:82⤵PID:3344
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720B
MD5def256374784b3037c0a85f02c470b17
SHA18a5f5bd5ffee9940e556b4d7d637c64ad15319ae
SHA256a21d1380f5158f68d6077ffaf800809f9a6e5544fc308cc21abac83131f589ae
SHA51235f053500e0ba155196817b17f52cb5e5251f0f7940c901fbd62a1d4b8a624bc06bc8cf45d509d68ddb00cb95ef14adf0aba63a9d3f576b6be204cc2cc52f367
-
Filesize
1KB
MD51b29d9f3b7980c8d6113e3518de56386
SHA1fa005a3620ad1a869cd4a0f3d2918c3bfc75143f
SHA25651b71ae3a10ac0c215dcda8e92119aca5b8975c55ea2e0bcecfdb0a4c14a7e89
SHA512f143f87777153575c8240ad021f1d71b99ada2addf1f36949a198235178e07b88d2e5554d16efc6b559a098167286ca4fa9ab2d18a8050b73e4246e96bf76e44
-
Filesize
6KB
MD5b42be9fb4220110d4f996e31310f1706
SHA168d83673c3b930ee3e49e6bcd19a69e039db785b
SHA256cc8cb84e820d9d20af54e3c3cbccec727f57c0e772a34ac81c3fb4044127f8f2
SHA51219e90bd7a0b6258fde4ac48686f8d0be217be2449b54d3c09939c13102bcef04cab7da1a247dffbdcd2c7fa9c8791ee4c9fd4a56292bb6e4dac35bc4270d9db3
-
Filesize
6KB
MD561fe4772b1958f07c78df2f2dbd5d79b
SHA13003d911215817e9138cf949e5881a68cce0065b
SHA25623fbc424d9a71291dd99686c01dadd22db9a3ac0560935d569b14f4a0d08b5ac
SHA51205a7f36cbc4219275d87eefa4433edcc4b3531cbb1e29a298ed964f108cc9e80eaed72e5534c77c14fc3cd417a9504a703f631afd0471087dc12f63cbc44be63
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize56B
MD5ae1bccd6831ebfe5ad03b482ee266e4f
SHA101f4179f48f1af383b275d7ee338dd160b6f558a
SHA2561b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649
SHA512baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize120B
MD54a8242227deef293c8083ccc9556f4e3
SHA1803b40657423d26867f7859dc2f1051c303584ee
SHA256910b4f0371f0db3764c38f2ef94c37f9a3b25c5078ade55170f5e456c9559330
SHA51261a6ffad22b818e8087ef7d0fb9e0e4df0928bbab3566398be288f53dc24edac87a04ddcf8dfdbca5363bc441c3c1a2abf0f65ae0476a8ae8b010ea6f10ebbd6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57abff.TMP
Filesize120B
MD5d9ef830f1a19143ff62fbe9f5e31c834
SHA1d146e58675510ed899c9c5970c130e4ded6275e4
SHA25695e27330a9027380b2ceb9a7b8192f130a3ff6f88571064d3feb42b3f7222876
SHA5120f0628b1af58cc8f5c2b075c166f29c8746aa86f50f8b2d0eddb17be88416fb80323120ce0d563f74b4dd8764395addd12a086ab1196a647ff3a5b223aace9aa
-
Filesize
97KB
MD51afcd7a6b9f4db1a18dd9aa57298546f
SHA11be353ab60601d9b68ecdd4c6f424e5806ff3195
SHA256d93bac22ff9299ea3371a9c5eaf48332d969ff76a182d2daba7aca3893add300
SHA512bfb35cca91fc8ab981b0f491fa5fa8c0a684fb3b2404e1e281cfcabdbf33caa03064ba97305d32828e64de6e31b1562f40c17d8027f70d60a147774f80682859
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd