Analysis
-
max time kernel
300s -
max time network
293s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2023, 13:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.truyen-online.wap.sh/ds/4-loan-luan.html
Resource
win10v2004-20230831-en
General
-
Target
http://www.truyen-online.wap.sh/ds/4-loan-luan.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133383078446189364" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2436 chrome.exe 2436 chrome.exe 1424 chrome.exe 1424 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe Token: SeShutdownPrivilege 2436 chrome.exe Token: SeCreatePagefilePrivilege 2436 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe 2436 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2760 2436 chrome.exe 41 PID 2436 wrote to memory of 2760 2436 chrome.exe 41 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 1652 2436 chrome.exe 84 PID 2436 wrote to memory of 4128 2436 chrome.exe 85 PID 2436 wrote to memory of 4128 2436 chrome.exe 85 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86 PID 2436 wrote to memory of 2648 2436 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.truyen-online.wap.sh/ds/4-loan-luan.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa35799758,0x7ffa35799768,0x7ffa357997782⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:22⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:82⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:82⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:12⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:12⤵PID:1008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4572 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:12⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5000 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:12⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:82⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:82⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1424
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD535cd1b73ad0fc9affaee87aadb1823c3
SHA15f125526c3ed650396f34e499a2d9c63013a8f8a
SHA256f8ae5bdba8dd0e5798140ab3b71c3a0d2f9954c2cd629378b1bab45debb13261
SHA512314d7d345e2dc2a95b90a944c5c75a7be1b773534f99741520a9a05973b9e2c6d45689679e72eb168d4a01a502cb7ed9475f870b468de5931d5f468c5f5a5020
-
Filesize
2KB
MD5ef6c59503f3b44f707ef14fef682e4c1
SHA1bb87499bc809cd33267ace8eb97faa9dee5eb2cb
SHA2560f7cf30aab8ed81e67aee72cc180b2d18f4f390618aa796274d042dd14203f91
SHA512759d36f82036e50ca9d3796d585b8d9f58516c6a33e4f0f4d5223491fe7fca4f780371f342148ef4cd9fad07b2ef1db1fa5cea8231a8cff64dee72e7cdb58fd7
-
Filesize
1KB
MD5e5ee5ab89114715e1cb56ce3ea88099f
SHA1c1c05755e6c2a3eda768a79390797d4ace095d4a
SHA2566346340b512fe74ef91cd4a5fdf141cda32b743a04e1e9891278b58a291f172e
SHA5128d78456b156c434ea82affbedf531610bb936e403bea6570a98a9be1ca86bf7a41dff2ae2a1091abefd32c6634ad0dc43540339f61e67bcf20310e588ac3c019
-
Filesize
704B
MD5171147b6b2f2d24da2b77d2e9095658a
SHA1262ad479d9023a0526b0c4813d82ebaa42ba7643
SHA25647ca7e5d65b8c56ca99298e3b2d7e37acd291c7ffc80b66ea47ea5f4fb6fcd7a
SHA512a402a86ea6439b04a056f6e826a5024a21f35c575296e29b1ab7b29054a30b9ec3bbe5cfd69665f55ec525f17977f590dea1986dfaa35a5283da9c6b2ae2c84b
-
Filesize
5KB
MD5a6ced242aeb4f8211afae89f2966f8f9
SHA1778c1d4cd02c75957b3f2368900ed08bf5695623
SHA2562794114c05ae692dfbb0e0a9f950cb616cb4fba01683dc7c43521e1fa4a9dd96
SHA512e614368fda4bf7ee3494367aea9e9e4fc97d0c16e1a95baa74ad5c742e094e26f090588d09dcd9a358bd88ac959d766d61520a8e42ef7d9de0de98d7b22e407f
-
Filesize
6KB
MD580aa7ee6e418a4a930ea863265cfd799
SHA177b763eab4bac4f8bbddd5b13b7d9717b326ab9f
SHA2560094ad778a8956fce8ff8aa611a2159c6818201e8ba28d13bb5b438f342c59b5
SHA512a3316491d54f38f0c96513a575dd70381385021cb1fb91e72766b1728d9c16a4f6e491faf040928f2cb9bf02e7d80bb1fb6e05cb5cad4609cffac324e376bfc8
-
Filesize
5KB
MD59384e1eee452db6c6ab1f5d6de7ab208
SHA14b88547f56b8a397c5e2c1443f56211a66793e7b
SHA256603418e932e6a82950559427b91d2ec285a4ae867dd66ecbe7c318af71502f76
SHA512b2ccb39ee8883312970f3aab3455ee0bf7b09c34e40c6571b4bc3c09f0ab363d74d4871954190f2aa78fb2f0e504c6b987b20419843e6885873fa7048a7deca9
-
Filesize
97KB
MD5339a8acb59aac058d634243acabe762b
SHA18a5d657e6bde6a4ae669e3b4235b1f46a89f4029
SHA25665517ddf62a3ccf506fcbd2c581d89627c2217737e1fc1798ea3bf88807bb3e9
SHA5125d1890a9057d14b9751d7b5004377555573c0a8388c12f304c6d90c4885a2dc5d78119648e9e755771448d15b69227e37ec040f142a2d3edb237cc7ccc582d9a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd