Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
05-10-2023 16:23
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win10-20230915-en
General
-
Target
sample.html
-
Size
214B
-
MD5
907fc06f5b514bfca9da248a6aef475d
-
SHA1
f20eada7beeb6ad7e82f54290e2c2f6fe10c37e1
-
SHA256
cd43ea47fd01e187d285b4b5928414e3261a310eb75c7deb28120b1d942bc91c
-
SHA512
14728b69a5343bdca0af725b3873ed18f9b3d94772e4e2af2956239e7bdf25da19662f1905cad49e472f43d81d8e1724c52a39b92c75a84e5965e087ceef8571
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133409966031886092" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4872 chrome.exe 4872 chrome.exe 2912 chrome.exe 2912 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4872 wrote to memory of 4868 4872 chrome.exe 27 PID 4872 wrote to memory of 4868 4872 chrome.exe 27 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3544 4872 chrome.exe 71 PID 4872 wrote to memory of 3456 4872 chrome.exe 73 PID 4872 wrote to memory of 3456 4872 chrome.exe 73 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72 PID 4872 wrote to memory of 3536 4872 chrome.exe 72
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe7c129758,0x7ffe7c129768,0x7ffe7c1297782⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:22⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2064 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:82⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:82⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:12⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:12⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3840 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:12⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4592 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:12⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4504 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:12⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:82⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:82⤵PID:988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2840 --field-trial-handle=1756,i,14974739999883428092,15209690043101708603,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:336
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD51b0145923a8b2811313f56b4eaaf55d7
SHA1a15b2ab90289ff3af4f05f916429d6496545ce29
SHA256f4ca47f119d20b9bb324825f91d5afac0ba7710f2857af8fc991ec29650e0f34
SHA5127bc705e6040750543a28d8da717293a713c5fbd41fe8d48aa2f27c0149234191bd54a5ba640efe10b47f67ad0bde316b295b30992b726db4c96af8ed6406bbaa
-
Filesize
2KB
MD53f6c7adae0bdff49e7878486a1a38b1d
SHA116aa8670389fdfddebafe7f1475e841d6879c274
SHA256ef1c91f227b92307bf993ca12c143de737f0c45ad9439a653a36c70a34694af0
SHA512d4d54808682c28cfa2b2070c24e4e02ccc0bc6dbdcc62774ee1231a7bd94e68371924c22bd77b3ee74b1633f925f2e9b99940a99802e57b21518211cbda0dd97
-
Filesize
538B
MD5cb71304618e6adf375922f5b78c63af5
SHA11bfdb65a4531f77fa5f8be1b17d9efff5c7d0c10
SHA2562449cd4622c72bf842e41a9f3f483bc4723d64c163c5834d66d18fa337660092
SHA51254bbfa693c1db2590522a302b34a0ca3632cc447bc0f35f0e141856d77af785204b2fce6faf77f9c0bd7bfa366c58ed9e8040fd733a6b4d4b7f11c0820483a96
-
Filesize
5KB
MD57c5188777b5e1869c5ae3ee97938f0e8
SHA1997c32d17559729920368a76251cfd60577b399a
SHA2560a4c3daf62c8894be47417be96239885fa7c4d1433b6bb9d7b954f3d056f38c5
SHA51216c16bcebd7d753d0bd47a2822cebb650d3227947b928b58c476daa1c418a15655eab442feb1ff135ec02861f8959d3161b63b5a888f7d1de4d092bb9aa3eb47
-
Filesize
6KB
MD59819a60162467ad713387da78590faad
SHA17d475706432d51243b77e92687cc3c7186b396a7
SHA256a6ea7cd0795e1ace919139b0a69d2e3e4ebb656970ca142b97612a4d47854e81
SHA51280a88fe8abc83cb661866d43edc9bdcd52398a1bf23d1f47dbd81e1117da166d46727d4408ead44a6270db46bce9cea2dc351f714ebf05262a1aa7a09e984297
-
Filesize
5KB
MD52c2ee2f1eb1c6df866f0baef9dc09b94
SHA1fa27c2b1f95b68e9b09c1e86c8d71359cf215e74
SHA256a363786c059ffcb68f0023bf5addd76165645105b92c6e12912957b30880aa21
SHA5123b370b13fb35aedb4c7df9cf03c58c106d4ecb0683a325a55c6406a47590ab7df238ab4852235036deb3fddb4d3f8ddcbde40b53371254382fb7d061fdcd5f92
-
Filesize
101KB
MD5bdef0a22183fdd5689077a1bc34c0ea6
SHA1b154b565f036f80fa14a409f4c926cdfc3c5fc8b
SHA2567abb1ccc242d3981be112628b229fff658ffdd6e1951c290a2a4b48585e9fcfd
SHA5127dec1855d8b4d4ac9dbfec23595a0325f6171652216caec94a947ce935f44421ecc7b802b68bb553acddbd7137562e806290253d1f880f592aa3fb68050a9c67
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd