Analysis
-
max time kernel
299s -
max time network
297s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2023 20:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://groups.google.com/d/forum/geeksquadclientsupport3242063jonja
Resource
win10v2004-20230915-en
General
-
Target
https://groups.google.com/d/forum/geeksquadclientsupport3242063jonja
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133407532599975687" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2240 chrome.exe 2240 chrome.exe 1372 chrome.exe 1372 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 4720 2240 chrome.exe 54 PID 2240 wrote to memory of 4720 2240 chrome.exe 54 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 3844 2240 chrome.exe 89 PID 2240 wrote to memory of 4736 2240 chrome.exe 90 PID 2240 wrote to memory of 4736 2240 chrome.exe 90 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91 PID 2240 wrote to memory of 2020 2240 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://groups.google.com/d/forum/geeksquadclientsupport3242063jonja1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff931c19758,0x7ff931c19768,0x7ff931c197782⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1876,i,6089686134972184115,4365437862188542060,131072 /prefetch:22⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,6089686134972184115,4365437862188542060,131072 /prefetch:82⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1876,i,6089686134972184115,4365437862188542060,131072 /prefetch:82⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1876,i,6089686134972184115,4365437862188542060,131072 /prefetch:12⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1876,i,6089686134972184115,4365437862188542060,131072 /prefetch:12⤵PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4580 --field-trial-handle=1876,i,6089686134972184115,4365437862188542060,131072 /prefetch:12⤵PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4788 --field-trial-handle=1876,i,6089686134972184115,4365437862188542060,131072 /prefetch:12⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1876,i,6089686134972184115,4365437862188542060,131072 /prefetch:82⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1876,i,6089686134972184115,4365437862188542060,131072 /prefetch:82⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1876,i,6089686134972184115,4365437862188542060,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384B
MD57e1242848a32ad7c99b25f56d7f99a11
SHA147d82ca5f1c2be82703942c02a4c168e3ecf2831
SHA2566b1b188566885b1290498cfbcb729b3d88bad592c12c2b015082258d5fda6384
SHA512fb9b01ddcfb1f423941d9618c4f06c3544cf881953dfa5ed42588eb272fcc1d5aa5d167f77f0833f1dd226fe784c5cdb4aa839be543f998e0007e7bc7700b887
-
Filesize
3KB
MD54f79c04bf17ae38f8f0dcc3ff8ff6d5e
SHA15814545bcef5dbdaed0903ee6002d3587acc29d9
SHA256a8ad773aa86c89dcd4eb3c8806423e13a435a9f13fb4f59e2104b52d5af687db
SHA512cf9231d25e487f997a84fd6b9fb577fb0800347e0f5dcfc7954bb2e0a2e1ced9d472eff8d2bd700ece75f1768cb15d2227afe6c9983726b09a7ac3ff285e423c
-
Filesize
2KB
MD59266693367c67e5fb5bea95166295a24
SHA176e17d9079c6b8255a4c4298898453782346e9e2
SHA256fffd49afe16767121ddea80f48963b76d8e136c94685105cc32712d2664e5c35
SHA51200beaea82bda4d168235b5d200c3c22f8fd0440364f1a7cc0efdbf6ebcaf39e34da6409ee17df103cef2a68aa25fb202cb4acf64ccde1482ac90b9419e1c2b2c
-
Filesize
3KB
MD5ef32e47da007acaf7f82c937194b4e37
SHA104c6065104faa9098a00ab88e90d3dda9a2ca428
SHA25662ed6c48a69011d6877c270ed9330c9aca3f3068f646b161e549ce5ca6754167
SHA512cd519c3218411396009351022bc14f9f8a36853ff0f778a5cd51b150c839bd22db14cc01ec06d7deecf5d8a2cbbc6e844286b34161c848a0ff8624045a5bd9b7
-
Filesize
6KB
MD5eadcb8082133acf9a7016bd2f49ec96b
SHA172783b3803d12566b4a3a636c801dcd8962e47fe
SHA256b7ca805a9a478a6d3099888877cf0c03e318a167e11c80d36b0f8c1309bc9c30
SHA512c5052e7984f750af76d5049282688aaa5e9fd3fdb6e957cf5664fa96bc7c790801e4809419537e660d35dcb79dbea02ffddac75b318e4c230b00e728af8a8c60
-
Filesize
6KB
MD5284e6f07262aeba693a026adac566f44
SHA15fef7009c9aa3ab26c988ba9509b114197596eb7
SHA256976421dc83d26f6f921748aae43329dad73295f33edefd260b43b2d13721b6c3
SHA5120310d150bb624f700b66a9e8f5cf2548e4614415f2d3248a46f04e609d48e2a0a4fca471f6426eb2a91795da8abcdb601374a49fd139d3b8be4056c4b5f70773
-
Filesize
6KB
MD5cfe46250cdcf48d06896f724c62e0375
SHA127caac9d7f375ba23933a73ca005f9b765349332
SHA25607d1dd5c48ba0edac863d0f13408fb02b1fdaee287f518d55000db6c42963b59
SHA5125c55c1c1f3365263e8b755d628dcfc6ceb5e378b2efb19b0969b63eebabaaa77a0697726fdfbe8a6ca4f85f5abd83c100cfebba819a0becb3f41bcd9852f73bf
-
Filesize
101KB
MD50c03a440b3909ca0958cbe57205d8f7c
SHA1467b6dfda9852b90e61e7def88f54e0c4fbf0101
SHA2568d442c6a483db29e797fbbdd289e650ac9cbb77514504ad62b8fea412bc3274f
SHA512aa9fae4b08606d98b27f27c3cd959cd0cd75c2e2990a2e8ab81fe7f2eed88f2539b83802d3ce74fb1700ba3decbd517df37f1a4ee8a4d4faac7f9ebf447c3a7a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd