Resubmissions
07/10/2023, 07:19
231007-h5wqrsca56 1006/10/2023, 17:57
231006-wj28bagh68 105/10/2023, 13:51
231005-q5yt5adc98 1004/10/2023, 11:32
231004-nnn79abc3y 604/10/2023, 11:01
231004-m4spyada28 1004/10/2023, 10:53
231004-mzfjtaba4y 8Analysis
-
max time kernel
1859s -
max time network
1820s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
06/10/2023, 17:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com
Resource
win10-20230915-en
General
-
Target
https://github.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133410886944433315" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5032 chrome.exe 5032 chrome.exe 3088 chrome.exe 3088 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5032 chrome.exe 5032 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5032 wrote to memory of 1528 5032 chrome.exe 71 PID 5032 wrote to memory of 1528 5032 chrome.exe 71 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 3968 5032 chrome.exe 74 PID 5032 wrote to memory of 236 5032 chrome.exe 73 PID 5032 wrote to memory of 236 5032 chrome.exe 73 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75 PID 5032 wrote to memory of 4172 5032 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffbe0639758,0x7ffbe0639768,0x7ffbe06397782⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:82⤵PID:236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:22⤵PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:82⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:12⤵PID:4180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2856 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:12⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:82⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:82⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:82⤵PID:836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3088
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d56705afdfa2b9d727ad5499b5358fe1
SHA1c883f9eee0e6d9d1207dbb14e45ebe3cb05b8213
SHA25601edbdfe9eac8506c67e9ae189833159e38ab45c10b93ec2147c651236721c2f
SHA51268af082a14914c823749d8082dcf716e383889b5bbae14042d186c984b80ba329af986f902cc8d82fa94e01d405dc76375252bc19115e88a6a563ffc5988e71f
-
Filesize
1KB
MD52547ea5ce7964ec8f6d4dbc8e6368bbd
SHA14df7b39ad6c020be7abf33e4861e4c192bbc8b6a
SHA2569a819e6df8c5cbe2d290506d31fe396c0174837147588de90c17e3e1f4f9d165
SHA512baf006e0cd905587ac07614d5ab622966c663cd9c4217d0e7a277dc4c32c6c0fb5a9710702b30f8f41f30c9ce8c19a53b7e26291485d32c7b3ad59ec519ced1e
-
Filesize
1KB
MD50354b2d80e94c2c1e96792526b6ad701
SHA1fdee043fa4a86557f034f7ec643bdc59f5ecac45
SHA256b4881f58eeb8b86a64262f690132e84088e6b6dc461917ac87d5310f0c77f3d5
SHA512c5f6dbabda4875467e927184f4ab14850f3d9371d99ebb8227659bdca99479f209275b037cae013cb1c4b77de76b31f33c27e01503c838d8962bd64798550ae7
-
Filesize
1KB
MD5e7c132b50901a371cadaea55da8ffb7f
SHA1d2944f05579f93beb288759d3b59d3c29ef0bac5
SHA2565de9dd849cbb426f086e01de92d5b730c34b6921dcddf45804a9bac47c36099b
SHA512f69ef630fbf5c67f14467f588616e1bcca6df4e1065ec52e25581027a58cc1ed22efb6667965d499875064966f38c6bfe8147d4992ec1b215df9c288f81f992e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a004b22c-c32b-4729-aed5-93fce5c26160.tmp
Filesize1KB
MD5a34a379655f915983ae85ac3264636c9
SHA17b6d092ab4dc1cf83c70fa3d48e9c175b5563e76
SHA256c7b126954d57040c8c4b951becdf982836246c1e598bcc49ea9f3a4336e0ed57
SHA5122f69741f45e5e9e1f012ec262eeb95b38d1a39ab4f178c36a721723b6d525c4fd0147b7c8cfd2a50834471d769dd7479deafcd126e58f55578505842c9e6a70d
-
Filesize
6KB
MD5e981e3b0622c7d0058b88f1636a34140
SHA1740318368be954198b3df9ab7b6b0d5eca71ab33
SHA2560d51c1e4f7ca08e99d486b5e836bb4ab55264e6638955650867fff09c1076342
SHA5124f7152671cd56372f58f9a3ef4dc9d64f8df0bff655eb308842480689ea504ac52bca5b32ff2e3ea1036b946c85ec3bcd0fd6cc812917a1d28a8162af37de28f
-
Filesize
5KB
MD5566fe2d4fca644d081cd9feca41c45fd
SHA1101c14ac484d85dcaa841c453713ce962c5bea75
SHA256b247955aa14b3edd4ef4a1a95a5bce4a69cf8b868153bd45dc84f4f04b0b94ca
SHA5126041695ef3901880374bbd50979c353dba69adce94bcc393a0da99360dc9ffffc9a59e2bb7ae8276468598b57aae7ced1fe06f414230126fa6273dab8c6cbd91
-
Filesize
5KB
MD528a0a9f28feeafa273fc8654130aaf7f
SHA15d436bbc5e0208504597ac5aa91e59a1a22bd1d5
SHA25669a9136e62659cd00c54a88ef31444393306f9ed3e82e460a7d685b7be41313b
SHA512d81cf95fe2cd64563c43ec117daabeeba88d5955ac02f665285f9478d006b3edead36db427cfbdfd13ad5d14fbbde8b530b39d21fdff833b29c8dbdf1c449484
-
Filesize
101KB
MD56a0091353cef8d8bdd61be38e737c3b2
SHA18a0eaa3d7abf7863b911124fadb39d362090ceb5
SHA2560df7d35f7883b54670b7f4c75f1d5cf89ae58e01c0f9e4ca175fd3aa536ef340
SHA51234c8f060a03ebddacd12e5c7ec927f40bf9cb294ecd739f9cfc4002a6f1db8476ea17390679575fdc0c6cf69117365a6a18bbe01f1d759533ecdd8f83c69bd33
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd