hxxp://mksat[.]net

Analysis

max time kernel
311s
max time network
309s
platform
windows10-2004_x64
resource
win10v2004-20230915-es
resource tags

arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/10/2023, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://mksat.net

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133413604739122379"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
3020	chrome.exe
3020	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4760	1060	chrome.exe	36
PID 1060 wrote to memory of 4760	1060	chrome.exe	36
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4576	1060	chrome.exe	86
PID 1060 wrote to memory of 4672	1060	chrome.exe	87
PID 1060 wrote to memory of 4672	1060	chrome.exe	87
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88
PID 1060 wrote to memory of 4832	1060	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mksat.net
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc59869758,0x7ffc59869768,0x7ffc59869778
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1840,i,11706555752658530844,10074935342715249665,131072 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1840,i,11706555752658530844,10074935342715249665,131072 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1840,i,11706555752658530844,10074935342715249665,131072 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1840,i,11706555752658530844,10074935342715249665,131072 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1840,i,11706555752658530844,10074935342715249665,131072 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1840,i,11706555752658530844,10074935342715249665,131072 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1840,i,11706555752658530844,10074935342715249665,131072 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2752 --field-trial-handle=1840,i,11706555752658530844,10074935342715249665,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
3d7be5143988e25d0417e14cb2be4c28

SHA1
2dc512080f80c8a538e781e2a8914a4a8ee67595

SHA256
0fd7d9e686456068733f0b37f96f8d1986297b437a2244a8f9c27c8f2929696d

SHA512
2f8d9ec4e709f618de7808ef495b0f9c6dfbb2d1897471e3ca0fb80f82d93c6b8275003b0eca3947331e6a204bbca43c5a1a6c9874a59165033ee0c00644b75a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
5ced90ace5537e094fe006f5918de92e

SHA1
0abf99b08c4c6abf45cdb1ca91b05c60af20e4de

SHA256
8ebbe31f2a7d672c581c91f982e7c367afab5408e51af1c82289c7e66fca5bab

SHA512
0cdd1ea78c9c354503e33149a49bd73a4c157b25a21fecedcccb0d37a2aa7e390974fc9c78d13841da9938100ced40d4f97922dfbe3d1997de88a289f9dee1c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
537B

MD5
a54665df55c2567596143b50d698705d

SHA1
d80bbe65be4ef5525a8f542b03390e7fb39d2828

SHA256
2395b44691589e1a36950beceef7a0bb2b30b447c39291a7fbfb741267c8f9db

SHA512
ce212ceae6d60bf6e40802ae1fbc08d0121ecd3764fa4735f27ae429bc018439823fc24c1fe07236fe06f332f91607ad88d88ff2e47d37866aa4325a693e40d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ec02404d53cc70036e5ef1c8b5d1406b

SHA1
98162c177c1edb99d9fcd01f07ea058906c0c28b

SHA256
4124002add51182bdd3898f510c96776efb638b8ac5b1d06abfc9872b425a6f9

SHA512
bcba8b8607990a0d449b77ae7a08fce96a416b59c658aa740aca7af39849db8dbb1d8636e5b6ac11a6d4cc4db412bc472e57c0f032d0c960a8dc4fa33dfccb11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
9895dcbe9314567ad4a7466692803e0c

SHA1
bb76cbf8e31470cec9c1d528e8fc176ef5da8dfd

SHA256
eb0e00bd9d0062e3e09f0a938be500e826e1edb3f301c5f361cf79cc0a6a9e4a

SHA512
aa4e0619a812841139aa124cd4e3a01d10ec77f003ab68b0b70506fce16c6548c767c4df3652b650b861160fbd9c6e83f1c1f88a2da3536bca867b3247c27a4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit