Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2023 06:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://fonts.googleapis.com/css2?family=Sora&display=swap
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://fonts.googleapis.com/css2?family=Sora&display=swap
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133398380546490581" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4164 chrome.exe 4164 chrome.exe 680 chrome.exe 680 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4164 wrote to memory of 4460 4164 chrome.exe 44 PID 4164 wrote to memory of 4460 4164 chrome.exe 44 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4944 4164 chrome.exe 89 PID 4164 wrote to memory of 4636 4164 chrome.exe 90 PID 4164 wrote to memory of 4636 4164 chrome.exe 90 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91 PID 4164 wrote to memory of 3808 4164 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fonts.googleapis.com/css2?family=Sora&display=swap1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2f6e9758,0x7ffb2f6e9768,0x7ffb2f6e97782⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1892,i,3943068993151746475,2266772994114476505,131072 /prefetch:22⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1892,i,3943068993151746475,2266772994114476505,131072 /prefetch:82⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 --field-trial-handle=1892,i,3943068993151746475,2266772994114476505,131072 /prefetch:82⤵PID:3808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1892,i,3943068993151746475,2266772994114476505,131072 /prefetch:12⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1892,i,3943068993151746475,2266772994114476505,131072 /prefetch:12⤵PID:4156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4576 --field-trial-handle=1892,i,3943068993151746475,2266772994114476505,131072 /prefetch:12⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 --field-trial-handle=1892,i,3943068993151746475,2266772994114476505,131072 /prefetch:82⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 --field-trial-handle=1892,i,3943068993151746475,2266772994114476505,131072 /prefetch:82⤵PID:940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3576 --field-trial-handle=1892,i,3943068993151746475,2266772994114476505,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:680
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b4599dab5a7829546cf43e0e0df3679d
SHA17de086da4e763fc5a90a8f38ee701eefa4bc68e9
SHA2564c5d581952d73f9dd87c13b84144a9fd8e2c6d598f3674685ac3a609f1754f92
SHA5122010a1fde291361b5835680a5823554858df8f1510031b725315eab8d8a6f1f40a07ef0bd8627000b61e6b7d29e125de466b338155cc8ed6221e41ffab2a95be
-
Filesize
539B
MD5751857597e25f574c2c5916474c1f136
SHA1df5612a7a53c6b0b525eb8592f460b946d9e7fc1
SHA256de76cc96a0350911f26d4ae76b2ee4232edd52e7b70d48078a33e319a83d1503
SHA512eb5f71edc4c7b3a8b5684aa96d85399172f38aeddcd27dfb9d5b5834e4333da02b4276bbac70066bff348718f438a0bb91489d6f7238f7e0f5c27988a952507a
-
Filesize
6KB
MD565f71aa7b77d2f7e214b85078e8225a2
SHA1e83513379c80ed7f6471aaffa1907cd2e4324518
SHA256e0e20d9d29439f54aabe9b7ba12b107b55356883f155e3b693b8fe1b008ba05b
SHA5129e4d699ec36bc63b5980395f1ea86c611cb654e22ab418dc72368cb7fc04f8ed7e5a4b4e7e9487451d4b1f453a3fc8828fc0e2bd24033d8ccbb0ed851541cf73
-
Filesize
102KB
MD5b2114020ff0d9382c89ef4eddbfa6c9d
SHA19d1f1c35464167be53c5396485aa87a15dde3426
SHA25676c61f01a361504a83a82cfc298a8b3f66bbdd4c6ddf4d2d7bfda032388a471e
SHA5120432336fbae5ce1e989a455d76d5a56520e1486ba956932275c9ad07c5ab67fd1733d20f0681389ee7ac572cb7a5d29142cd8a87e12ebce5fe040a5de3554841
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd