Analysis
-
max time kernel
23s -
max time network
27s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
13-10-2023 10:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://c7.eu-3-id5-sync.com
Resource
win10-20230915-en
windows10-1703-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://c7.eu-3-id5-sync.com
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://c7.eu-3-id5-sync.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416682701453622" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4020 wrote to memory of 2168 4020 chrome.exe 56 PID 4020 wrote to memory of 2168 4020 chrome.exe 56 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 2916 4020 chrome.exe 73 PID 4020 wrote to memory of 784 4020 chrome.exe 72 PID 4020 wrote to memory of 784 4020 chrome.exe 72 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74 PID 4020 wrote to memory of 2184 4020 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://c7.eu-3-id5-sync.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc90999758,0x7ffc90999768,0x7ffc909997782⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1664,i,273714652639424102,1622091694412475323,131072 /prefetch:82⤵PID:784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1664,i,273714652639424102,1622091694412475323,131072 /prefetch:22⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2060 --field-trial-handle=1664,i,273714652639424102,1622091694412475323,131072 /prefetch:82⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2588 --field-trial-handle=1664,i,273714652639424102,1622091694412475323,131072 /prefetch:12⤵PID:420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2580 --field-trial-handle=1664,i,273714652639424102,1622091694412475323,131072 /prefetch:12⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4368 --field-trial-handle=1664,i,273714652639424102,1622091694412475323,131072 /prefetch:12⤵PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1664,i,273714652639424102,1622091694412475323,131072 /prefetch:82⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1664,i,273714652639424102,1622091694412475323,131072 /prefetch:82⤵PID:3012
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f3be2ca7-6c35-431b-8699-e4ffedf84003.tmp
Filesize6KB
MD5f8d92367452e84c2e580b27de1fc172a
SHA16fbd72877bd46230d8ed500298337c850979c192
SHA2560d8f633bdbb99c24ffcbc2c09f080281fa28c5c2dd744e4d92efb80a82902db2
SHA5127f98d687505c0b1ff27db142bf0d6bfd89c2f9f1f8f7540c2aee78cfbbb87c9c0c3ad4731be9ab11cb442852e32de9698e439554e8c7ccaca2479d7dbb2d0937
-
Filesize
101KB
MD55273a9711dcdf1c194761a303e8c5136
SHA1fae1e6fcb3ac840ed0ae31115a4e8b6269ac26b4
SHA256761bf5296705455e5123fdbd4936f69012c5f5a2476eee9a3866d7f61ac9336a
SHA512f659a61cf0720d8c6a4a8136f18b0a79d489eb380f60b2148e04ee0606cb91cd3d264a8d68a1b0d893035e5a347e3e7e0a430e2d0623e7799a65f6496db60b3a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd