Analysis
-
max time kernel
617s -
max time network
606s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 20:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.champlaintechnology.com
Resource
win10v2004-20230915-en
General
-
Target
http://www.champlaintechnology.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416158277350697" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3244 chrome.exe 3244 chrome.exe 4092 chrome.exe 4092 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3244 wrote to memory of 1348 3244 chrome.exe 34 PID 3244 wrote to memory of 1348 3244 chrome.exe 34 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 1720 3244 chrome.exe 89 PID 3244 wrote to memory of 2832 3244 chrome.exe 91 PID 3244 wrote to memory of 2832 3244 chrome.exe 91 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90 PID 3244 wrote to memory of 4140 3244 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.champlaintechnology.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3a1c9758,0x7ffe3a1c9768,0x7ffe3a1c97782⤵PID:1348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:22⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:82⤵PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:82⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:12⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:12⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4696 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:12⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:82⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:82⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD508cbc7aea3933dd8ba15ec26762502d0
SHA1898b290c159e21936d4c69aaca9365047a5e80ad
SHA25600a3ed4c6d15889ad8fb9ac17d5358a446eacb017fee252ef914954fb0df34bc
SHA51289367e8e628e359184ca6f29ceafe1bed39384aacacaa84727992ba1bf0b163cb622c08257b67baf3cb5b27064c4313ecb4d4df739c71739dc7c46a79468bbfc
-
Filesize
3KB
MD58dc24724fbe54038b6078606a5a46f98
SHA18b64a0bc3aaac668051c4f61dfd0aea4513cb27d
SHA2560a56771621003c051e90d1386343690119169589c7c6be65e70327b86be1d00b
SHA51235486836cc038d6ee19124cab0a37eb5d9414e9ffb11458abee835fc55783314c82e972fef3ebc381d5cdc0c0c69d928878f41acdce207d8b5194dc9e0f85272
-
Filesize
2KB
MD501b3bad760d2c59feab8afd8dfdf121b
SHA1cb0c4b7c83716e471d1e2ce9233105d6977c1cc4
SHA2565aad89982171844533ce895d9115e34e87a1e35bc9da4bc802b0447f41bd3f2e
SHA51286e8c8111ff4dfa32ce75707355f05d943d2f10a5bc5f36fd2ea75f383e3742019245296b4281b55373d2226328b4440e18405e5f876853dca3f3e32538d3a3d
-
Filesize
2KB
MD51884647d8f99591071b788b00defb078
SHA123c703170996f9f49dd8fbc5cf8cd696e197f3d0
SHA25694b0815aba05c7f39b0bb31c377e1f864075d77be78d8e6b881e91647e59a1b3
SHA51211f7d7f462a1b51298a169b8277f6ebd3dcc82350fbe6322b7f13dd1ba5270e068fbffa68c6939ddaacb743285b927d1ebf2f48c0885277d27d783b106555788
-
Filesize
2KB
MD5615d24d10c7cdf98092139471f59d976
SHA13144399ca486af48e7000dba74211b3dd43e6827
SHA2568caf8add45e76ef20a4c82efe40078c200e779c4c88ad6efc7f3386e2570fda9
SHA51211ff3135b0ea63dbfa3c6080c654a41646a0a53e65d79727da6f37150354a0093c77900109546e2b3328f2d0bd2d9308c380267a653be9dfce77527f1a4abd58
-
Filesize
3KB
MD521f4575e245626f93208657c2c742745
SHA16fd71c5be1d48f0a1bfa7a55282de34c3c88b1fa
SHA256b22551eb2897af1698619ca3b1ee5e2fe6d5fc75247a2af560cb9ff975780bc1
SHA512f6103dd874187fe487d6a12445a45770f368c0b0dbfe1f446d98d2a9418a1b0ec13ac168830e33b70dd93202e955fc1b3d15717d558ef279053ff71af86df41e
-
Filesize
872B
MD504505771f9537dc77080966f339c59b6
SHA196de147d21c691dc98085e6d925a7364722e3ef8
SHA2563c6de0010725638225ba33d37054c9bd83db765e3d6bb4eee3622b233bedff4c
SHA512eba54d80d6310a6ba5dba92f0837431ab1d8a7868561af26ba79e678b297da3a6371e6539399217f66806521a9251e059170968d34c8dab30046eb999674d398
-
Filesize
538B
MD51b27263ef6ca4f2f4c6ee5d169f6aa0c
SHA135a43db658594b2fa8b7c2696440deb48b443a5f
SHA256fde24cafac72d49c40ffe60e21ba476c800a0fdf9eb858c398056890329a458d
SHA512c264be87d8a5112ff129f9c5a7a38c63325e559209fc9d31bf6269a6a6cc6c280d282ff79a9e394202ba33ef9f0ccf49ba3f804f40e484ec052521df4f5832fb
-
Filesize
6KB
MD53e790349dfb327a5de32b8bcba3da16d
SHA1fb3ebe5de52772bdbb9408e7d08432f6c842b70a
SHA256e99bd308c1173d5bfca0faf979cdd8d3204c4b7bfc7a927543327bf456f4e9ce
SHA512323a688cd42db5f02ea2fbcf7af4b92e38588cb0c747b2701a8b5170d4fd881d1f3cba28845dedce0a277e5055881e2dd2bacc878b5718c515369368fc05bdd2
-
Filesize
101KB
MD5352a2bae0a42a0eb5b2b0e2fa4fe4459
SHA102ef8cfdde74008988018825d62acaf6547706bf
SHA256227d79c32725d9316533494aff0f70f24cc7a5f53665384b09fcc206b63b4226
SHA5124edddebff6895d9b8d5773ab5663494a2550b5cf87b79158621ea980808700c4a3369f93cc5971e1af6af89b6e5cdddd08facd2b767d239ad5c65a3ab69537d0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd