Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2023, 07:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://tracking.globalgrowthbusiness.com/prod/open/da0d6762-8f6d-453b-bc5d-ca61119e5633
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://tracking.globalgrowthbusiness.com/prod/open/da0d6762-8f6d-453b-bc5d-ca61119e5633
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133413965600914566" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5112 chrome.exe 5112 chrome.exe 5088 chrome.exe 5088 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5112 chrome.exe 5112 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe Token: SeShutdownPrivilege 5112 chrome.exe Token: SeCreatePagefilePrivilege 5112 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe 5112 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 1528 5112 chrome.exe 25 PID 5112 wrote to memory of 1528 5112 chrome.exe 25 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 4220 5112 chrome.exe 87 PID 5112 wrote to memory of 1132 5112 chrome.exe 89 PID 5112 wrote to memory of 1132 5112 chrome.exe 89 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88 PID 5112 wrote to memory of 3472 5112 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tracking.globalgrowthbusiness.com/prod/open/da0d6762-8f6d-453b-bc5d-ca61119e56331⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaab439758,0x7ffaab439768,0x7ffaab4397782⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=292 --field-trial-handle=1868,i,6922821957152440659,14148949369061077798,131072 /prefetch:22⤵PID:4220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1868,i,6922821957152440659,14148949369061077798,131072 /prefetch:82⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1868,i,6922821957152440659,14148949369061077798,131072 /prefetch:82⤵PID:1132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1868,i,6922821957152440659,14148949369061077798,131072 /prefetch:12⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1868,i,6922821957152440659,14148949369061077798,131072 /prefetch:12⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1868,i,6922821957152440659,14148949369061077798,131072 /prefetch:82⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1868,i,6922821957152440659,14148949369061077798,131072 /prefetch:82⤵PID:3312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 --field-trial-handle=1868,i,6922821957152440659,14148949369061077798,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5088
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56c99417a5c98c61f3f033a15eb639fb7
SHA1027519cfe69168c82fabdc809134b3367cb58e46
SHA256421f2f1d89d289d81bc8a2878f013dd900e5f67a1a669d101c87885a3751655c
SHA512213288911a6da621ab0be0a00beabc5b1558aca4305be17efe26c845dfcdd9bd4e72a805a675f0b80df48ef6877806d2733c6b535eed777611f65920c7dd6a33
-
Filesize
6KB
MD58489bead16e6989a10a29068a9f500fe
SHA1d7558de14a11153876bec8a442dc6be1a5b72893
SHA2565003ccc44fb8e10ea5214ffe29679683a1de17672974b1057a030d09af1b6c7a
SHA512cc8bd8c3e2872a67ab0e7b64b9d6768ed879dff4150ebf7b0974765e5109dd90d16372e7a5bffc15b91eeb8395f91f2ad9707631d5a88a86d618a77346532b70
-
Filesize
101KB
MD59a8a6de6adec3618ad8c516ee520816f
SHA1869bce301c1bcb18661778ae037b18440ddd3401
SHA256cdd3a856d19a5794fdfd181daed436f168d1cb8ab27d47de01875b6c3f4fd078
SHA512e64df4dfe8a6ddc982002c6efe503eeb4a48db308b40a37c2f04d4f41285fe23ccfeb78aae3f107ebfa7cfb55bf33c40bac21125b75aed2478eecafce9865a05
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd