Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
19-09-2023 17:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www188199.com/
Resource
win10-20230915-en
General
-
Target
https://www188199.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133396182064181730" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4332 chrome.exe 4332 chrome.exe 1644 chrome.exe 1644 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe Token: SeShutdownPrivilege 4332 chrome.exe Token: SeCreatePagefilePrivilege 4332 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe 4332 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4332 wrote to memory of 2648 4332 chrome.exe 70 PID 4332 wrote to memory of 2648 4332 chrome.exe 70 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 4240 4332 chrome.exe 73 PID 4332 wrote to memory of 3400 4332 chrome.exe 72 PID 4332 wrote to memory of 3400 4332 chrome.exe 72 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74 PID 4332 wrote to memory of 2336 4332 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www188199.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0x44,0xd8,0x7ffef8ad9758,0x7ffef8ad9768,0x7ffef8ad97782⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:82⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1560 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:22⤵PID:4240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:82⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:12⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:12⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4400 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:12⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4668 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:12⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4888 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:12⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:82⤵PID:1136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:82⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5312 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:12⤵PID:5100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3400 --field-trial-handle=1792,i,14852701641887836210,16057691182388228852,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD51908b72defdd85662e137f6190cb44ee
SHA13a599b6234e528e74252c88359ed17a8a2564dc9
SHA2562fd534646a9399eab9d95204b721040af33b53281a3ef88542c4f546d63a63f5
SHA5121a0060bb10dd21342f22b5d83a4860580aaf069cbf3e95c4f59332fa56fac7deecfaf06b4d07fc849b80ed4f9ac889e61f6f9d4b12da3e9f626d523bcf64d983
-
Filesize
2KB
MD500143f9bf3e020a972533ce98c1d20ad
SHA1c3bd6c40ea0a8bba9f69cd3d70c744ce9641914a
SHA25677d6d31ec8605081ecdbf355d6f78b9b4be8567cea42ef39a51ea6b3182e8c35
SHA512eeee80e73a8c8cab5b17d6651408ce3f783e6ded06228b73d9d278e7e581caa62ec25143ae28c6278174f065c76b6087352923af544514799569e83673901322
-
Filesize
5KB
MD5a3a1a371bf40d7153382222ed568927f
SHA13306dbf998c7b81f9f7d1c8a866348feb004cd45
SHA256ba928237070092eb782f2807a136cd3c8601c6e3543733380899f741e7fc589f
SHA5125f7ee3eff94705cc948f8d23f3e2173ff4d2ffbbff974936dc166e3953556539e0898398835c6fa1ca96f6019090c463b0916cfe49d7d4bd78595e544929a98f
-
Filesize
5KB
MD582871fc46b717a51956c7cbf6aeb2797
SHA11b9dc9ab3e387d6286dace2d40e29942ddce156a
SHA256b24926a5dc48fafb241a6603f098f3504efc2a2fd930cb0648638d20bf81b174
SHA5121bca73c220b018063081a69ae3554628e6aa89fba0a0a9fc0e47a5f67b221730e52d4be17dd43065fe51b2553479076a3ad07134e1590391320b495d9edb1746
-
Filesize
6KB
MD59cb675a81aa93d12f37e35b8b9d01cc1
SHA120dd15fc472f332ff464cffc101d68ed49518f66
SHA256bac831dec28433ae940832f9804a1b9630e4853904fae56b2daad5f11863e900
SHA51281d47e4068db4840a8a2b5ac88f3911af791bf0cfb95a4ca08ccf8335547d13d81bb8f260a1b2b804d015e3b0e4389d3a7562bfaf4719a9c4ed37b2f43f26cfc
-
Filesize
5KB
MD54a826f5a6e6f80274c1aeddab342b5d3
SHA18a5574342e7daaa98a768ae044006bac24bd188c
SHA256f9da769ee0c99b0d1dd0a4b186cc981d5e321dd7438ded4ebde89dd72947604f
SHA5124ffc68ab8d29619948a1c21180328cf16fe429d0bd5b0ea15f9ffb263f01e3f947d652de2722c1d01ea4133a525c08fbfc9e26d992a8c27ccc00fac84466fb24
-
Filesize
102KB
MD561cae4aeccd0a56d9f39e3aef454f57e
SHA1be67585e4f616c4bba95de81526e3b351740adb6
SHA25650bc15c49d3b0049fdceda27df96fbe8395a7a4942ab9ad3afbc210b2bd06254
SHA51213ed50a3f60dbc2ac15fc5b7df0ea3fb9c9477610e43a08837bb40a21dff94de71e1b78f87a5c17055a8698a419b25b7049d4579890655fcc03440adc3091f25
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd