Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2023, 07:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://goodhabitz.euwest01.umbraco.io/media/24kifv3q/directions-goodhabitz-bunkertoren-guests.pdf
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://goodhabitz.euwest01.umbraco.io/media/24kifv3q/directions-goodhabitz-bunkertoren-guests.pdf
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133395821549978992" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1436 chrome.exe 1436 chrome.exe 1544 chrome.exe 1544 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe Token: SeShutdownPrivilege 1436 chrome.exe Token: SeCreatePagefilePrivilege 1436 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1436 wrote to memory of 2036 1436 chrome.exe 85 PID 1436 wrote to memory of 2036 1436 chrome.exe 85 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 2604 1436 chrome.exe 87 PID 1436 wrote to memory of 1676 1436 chrome.exe 88 PID 1436 wrote to memory of 1676 1436 chrome.exe 88 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89 PID 1436 wrote to memory of 4856 1436 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://goodhabitz.euwest01.umbraco.io/media/24kifv3q/directions-goodhabitz-bunkertoren-guests.pdf1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7be19758,0x7ffa7be19768,0x7ffa7be197782⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1892,i,15171698418991032899,884707406468803805,131072 /prefetch:22⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,15171698418991032899,884707406468803805,131072 /prefetch:82⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1892,i,15171698418991032899,884707406468803805,131072 /prefetch:82⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1892,i,15171698418991032899,884707406468803805,131072 /prefetch:12⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1892,i,15171698418991032899,884707406468803805,131072 /prefetch:12⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3732 --field-trial-handle=1892,i,15171698418991032899,884707406468803805,131072 /prefetch:12⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4816 --field-trial-handle=1892,i,15171698418991032899,884707406468803805,131072 /prefetch:12⤵PID:636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1892,i,15171698418991032899,884707406468803805,131072 /prefetch:82⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 --field-trial-handle=1892,i,15171698418991032899,884707406468803805,131072 /prefetch:82⤵PID:4040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1892,i,15171698418991032899,884707406468803805,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1544
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53a76521a77389b3274500a031c659c1d
SHA1ec8ec2da55b92daae3ba3282caa70af891dcdc3f
SHA256c856e4cc795d62fbfa3c83b553958036259548f7e63cde83371ce23b3f00eaeb
SHA5122c05fdc1d5484ba00c0bd89ec776c184004f0a1b8fbb447c3a2f962fda956548c16c29832468b96b251e51ac51851e3bb8bbb9b254fcb1a4ad8d8ab1a01bfd91
-
Filesize
6KB
MD50da1a68c08d5abd06733197c0730223e
SHA17563839c7bb9ecef37661c0a2c523f0d13843d27
SHA256658ba0f1f55a4a9525556c10ed3f8386b03c0cd2540b00227cfc2f7e2a8b15a8
SHA512e50839dea4745ae9d1815566a3a222731c6cc5dec292fc1f93c734aa5de1fa11932b7061b507fa42e24a2ef44629b41d9b666ed023aeb8f74fe042feb0f9149b
-
Filesize
6KB
MD58cd70be2257f47ee6afb46493f3f4c88
SHA132696e49e6bae59892de6c85f1f741f3b9090431
SHA2566a02503db6dea530f2ba9eb6a6a772df912f91572e7bf842050662fcbde354a9
SHA512d6af386638f13d39ecce463c2f36515e7318dcd6a1c961dd9b15d88d4b7b3143a483b61cbc74fe9d226de87ea5780e87f14a128e170525862b1f2f3c1d09d661
-
Filesize
102KB
MD5b42a7ee711c41ffdbdb945bbcfb9f3f5
SHA10066138a7544da90e45a12d6edd713096ca79968
SHA256069159af3048f65ac442afd911004b83c47135971901cb6444d5538e6f437e8e
SHA51265799ebfbfbeee2ec0ea4c2a579c47b1a735beb03324f1d79e4992ba1f92b859524384f7265bb63788b00290b6400fb81954c9269ec9c6515beb3a112bea2481
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd