Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2023 19:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://view.monday.com/5276369665-4d5b4612c38b3ea705038100de966e3a?r=use1
Resource
win10v2004-20230915-en
General
-
Target
https://view.monday.com/5276369665-4d5b4612c38b3ea705038100de966e3a?r=use1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133410093868836794" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4440 chrome.exe 4440 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe Token: SeShutdownPrivilege 4440 chrome.exe Token: SeCreatePagefilePrivilege 4440 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe 4440 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 3664 4440 chrome.exe 18 PID 4440 wrote to memory of 3664 4440 chrome.exe 18 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 2492 4440 chrome.exe 87 PID 4440 wrote to memory of 4816 4440 chrome.exe 88 PID 4440 wrote to memory of 4816 4440 chrome.exe 88 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89 PID 4440 wrote to memory of 4260 4440 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://view.monday.com/5276369665-4d5b4612c38b3ea705038100de966e3a?r=use11⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff33299758,0x7fff33299768,0x7fff332997782⤵PID:3664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1880,i,12640303767378640527,2836203408103556107,131072 /prefetch:22⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1880,i,12640303767378640527,2836203408103556107,131072 /prefetch:82⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1880,i,12640303767378640527,2836203408103556107,131072 /prefetch:82⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1880,i,12640303767378640527,2836203408103556107,131072 /prefetch:12⤵PID:936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1880,i,12640303767378640527,2836203408103556107,131072 /prefetch:12⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1880,i,12640303767378640527,2836203408103556107,131072 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3864 --field-trial-handle=1880,i,12640303767378640527,2836203408103556107,131072 /prefetch:12⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1880,i,12640303767378640527,2836203408103556107,131072 /prefetch:82⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4960 --field-trial-handle=1880,i,12640303767378640527,2836203408103556107,131072 /prefetch:12⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5376 --field-trial-handle=1880,i,12640303767378640527,2836203408103556107,131072 /prefetch:12⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
864B
MD534b49ee6bcdbc950f47600559e264cf2
SHA16ae6768dbd7154a100855d8ea889c77c4fb1b63f
SHA25640beb24f66e74bef69a29c07c5302c3c39b0f91baf8dfae0fa1ac340b7bbed86
SHA51239238be660abe95ca64cc526aa59994b52567d71b95642b8d291950c10166940c5682e468c61edb9b9ef8789fea06170d539a241284dad3068d2a102bbce5a3f
-
Filesize
912B
MD56071d99387835c94fc4f0aeb32d75233
SHA15c96eb8877abc84aca621f2d2f8984cb3be1021f
SHA25603e3fe381efbb34765b78c48a8ce51356262e8313007f0850a94bd86c46f3389
SHA51263879874d8888b79cf65d55a7d0607d31292039c00590685704264feaaafe1a546f720dccfaa2262ea8106ce1277ad49477a656640b234d335cca97edba1172b
-
Filesize
3KB
MD57b3a84c28383603ffe5bd5adc7ad0aab
SHA13a8d1cadc57b90eb1864618d209a56509e39b57c
SHA256a3870028eabc038960f50771c1a245179dac6f463447f5b1a1cf4c9ee6d352ca
SHA5128d5da55df82fbf57b9609c5c9e0538b4d7303f454f37c812911f245247c25022f208bcb1daccfb7ad5c7d30c34389f04e2dcdc7c7258dba02e250ef6f3c278f9
-
Filesize
1KB
MD5cdf9a7b40a7d63107fa69b3b2b4ad4ff
SHA1f151d135806878dad74982dbd2f03ee74d22ee76
SHA25655ef311c13674869ab8931d079c8ab3b38412798de5548bd230a084cd234a75b
SHA5122423fe12ac415849b393178af19663472200157650ad4c6fa46b6a029934f73ba15e3244899943fd6079ba50c6647486ae1871885f7563f542893cd4a79d5aa8
-
Filesize
1KB
MD5937a5fc28c5d48af776c1776b1321b5a
SHA161795e8c0286da9a84371a895d9f1b66fd99a4e1
SHA256aee32b0b5a378ce7f02df746ed96de3b14e15d482d3ab39bec2a8c5034fe573b
SHA512728d082ab2678624ec0fd2448ca2bec26baff37c6cf976783d817a39b23b398abcfb2918ece8114277343428b8107b000d16479076c8134e83f7c01a824fda14
-
Filesize
7KB
MD5c8e12f6aafde7428e3488bca54ed66a4
SHA134711e51e8d8c158eb1be6b1327f57d70a7d31ae
SHA2568998435f7076428a9854079e8e65b6e5e62c2030bb01f36a370630721c55d781
SHA5124a978dab202b3778c351d42a08d6387d1a8d369be3604004b7091624756c7bd7468e8cc852cbdfe3693bf1c40a774068d3cbd69161647dfc487803d2422ca9f7
-
Filesize
6KB
MD5e5d48cac9390123f49a962332b8d4ce0
SHA1a0cf21faa55f371de18dcfeaafc0b32cc2c29180
SHA2560e56472daf43a0fa7fd1f1ad409314f4c0d2a2cdf195a6c8c8d6e48a9c1e5581
SHA51204e7c17e3b6834e5e69f4695c8839fbb1aee6810f0fc36cc8129e74b013ffd176d743780bda65ac261515de011209c7762c0ebb5953629665e7847e90f85c8bb
-
Filesize
6KB
MD5282844927f78ebd1ad28fec26703b8d3
SHA176b90daca01b2870d5af0cf0a16da2a907e7dfe8
SHA256ee83b03e8793941b07364efa938abac8e80d20297e424da6f6d68ffdc412218f
SHA5129b432c53181c71469aa1f020ca6321e9334cad2a244836ff7b218ba54c623cfd7485301437eeb575e1e5a0c13484fb6d8fc8c0641a5505cd3f8544b09941b476
-
Filesize
6KB
MD5af4abffa7f1579f24cd5c6ed17455209
SHA1cea7a1f8ec3bd3a330f6cb037bc1d03f1a82279c
SHA25607b190770d4e6fef43a86c467e69b4eea4398d305f5e1b7529a56d2bb0060b87
SHA512a8dcd0e248a476260cc44f6795c6fa61fac8d0009342a1531b5db55af1d5e8376bc6e38bd34a934fe45f860eb9d57746a6a303cdb3e6727360c8e6076fc5a498
-
Filesize
101KB
MD5d8ae90a017f57f3ce80de17ec31edaba
SHA108856b8a4d489d417878e90012639cf738f9cbd7
SHA256ac8a090f1516a9febcb54ebc6318333de209d1b46196170580bd202118e4f276
SHA512c6c4b9567ae0d0fcdba849560a05e714833552b5da06a79100a93956b839161335954261ff3acb4c958bf17738440624e5d7689a94dbaa13592ba61fad15b8c5
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd