Analysis
-
max time kernel
61s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2023 13:40
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gem.godaddy.com/signups/activate/MS0tNldrSEVtczlXL090K0RLM2FVQlEyK05jNVhwTWRISkJydDdreHA4VG5ZKzNiNG1YVmNtaXZMTzFVNWgzQ2hidWdCZGRDUHFyajdUSXo0dTRodz09LS1Xbkl2eEI4d0d3NHUzVmF2LS1DTTJUMzdRN2E1TmlHM0lvNWxrdjJRPT0=?signup=6918310#aXphbmR2bGlldEBkY2NjZC5lZHU=
Resource
win10v2004-20230915-en
General
-
Target
https://gem.godaddy.com/signups/activate/MS0tNldrSEVtczlXL090K0RLM2FVQlEyK05jNVhwTWRISkJydDdreHA4VG5ZKzNiNG1YVmNtaXZMTzFVNWgzQ2hidWdCZGRDUHFyajdUSXo0dTRodz09LS1Xbkl2eEI4d0d3NHUzVmF2LS1DTTJUMzdRN2E1TmlHM0lvNWxrdjJRPT0=?signup=6918310#aXphbmR2bGlldEBkY2NjZC5lZHU=
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133397772667775483" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2824 chrome.exe 2824 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2948 2824 chrome.exe 59 PID 2824 wrote to memory of 2948 2824 chrome.exe 59 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 4512 2824 chrome.exe 88 PID 2824 wrote to memory of 3992 2824 chrome.exe 89 PID 2824 wrote to memory of 3992 2824 chrome.exe 89 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90 PID 2824 wrote to memory of 3824 2824 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gem.godaddy.com/signups/activate/MS0tNldrSEVtczlXL090K0RLM2FVQlEyK05jNVhwTWRISkJydDdreHA4VG5ZKzNiNG1YVmNtaXZMTzFVNWgzQ2hidWdCZGRDUHFyajdUSXo0dTRodz09LS1Xbkl2eEI4d0d3NHUzVmF2LS1DTTJUMzdRN2E1TmlHM0lvNWxrdjJRPT0=?signup=6918310#aXphbmR2bGlldEBkY2NjZC5lZHU=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce2799758,0x7ffce2799768,0x7ffce27997782⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:22⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:82⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:82⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:12⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:12⤵PID:3404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4604 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:12⤵PID:1336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4760 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:12⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5068 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:12⤵PID:3252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5256 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:12⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5320 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:12⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:82⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:82⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5276 --field-trial-handle=1744,i,15287271833233416668,2601166378841533566,131072 /prefetch:12⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD51ec78a29319b91390ad7cd8ab202dc1f
SHA11d55ea386ac70f21e0e09493100251b95b261fde
SHA25696e739100125f24896024917cfccdc27a1a6d0620a04a0f0e750a85901370abb
SHA512567d7bf07612ce258932f0537ff1f0b5fe38c13a04352eee17cf7b1f00c42276ecc8cc0bc069fdc2a5fe18842b52833096bed64952849806486aac0178c9c422
-
Filesize
535B
MD5e21c981d0ea564f5a02ed08cec56839f
SHA12a1bc9540afa8bb1874327c64bab759c7ec2d8ba
SHA2569bb291ad83a5eb4c6af120ea424f3a7b8df9b7871978dcd181f029e1d76e8eb5
SHA5126e3be5aad05b1c43372498a1a9c0d15921fe147b7e29cfba11bc247a456eb5ed661db180c7e7b05d25b473fccfd14eee8130e41367785231caf3944fec15b935
-
Filesize
700B
MD5d592647008c2c26f19737edabae17cca
SHA16ad2249a9e14132a8739a0dc19a54d37b236f2ea
SHA2562c6238f7f4931cc35bd6be4f735a685f3d870a6d8c39df6984fe21e1a5d9d28b
SHA512d644fed7cfcb62f47fee9e6e58098885d0ad178aafe19d6129c9e08049bb2a5c4285c46924d77e8a1eae8dd4f2621c0219db42d010582b7d98f320309a92bbfb
-
Filesize
6KB
MD570f8b37ae489551bcd47a902df1ce852
SHA152a54991da9a2218d0467e41daa29416678d0782
SHA256c5abd2f9df8f7df9428c5fa3055d655ea80bba7705c8026402b4c19e4e71a9e2
SHA5124bb397aa53d65cad5b9eb10620e1db343ec577f611deda991687b641b6eb8955ecfe4d6f380309327ff417a64ad9e6e6fd42b2407770024490a5038a525cfe09
-
Filesize
102KB
MD599de3708622f9960282bb6e3e1564ada
SHA1ede2249f3c0ae9e4abf4757bcfca48ff453b4766
SHA256eca558c320cd58f063915e72f6828251c79ba9a5ed5516e4523556e54265e14a
SHA512ad6420e903640bb04bdcab4b33c695265f05f1d7b71dda93dee208b8f9690a5291bf64b4332b9e6fbadb3001977d28380792aa9f62613003a9d8fb4992dcbcf6
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd