Analysis
-
max time kernel
156s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 10:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://c7.eu-3-id5-sync.com
Resource
win10-20230915-en
windows10-1703-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://c7.eu-3-id5-sync.com
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://c7.eu-3-id5-sync.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416682597339065" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1092 chrome.exe 1092 chrome.exe 100 chrome.exe 100 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1092 wrote to memory of 3784 1092 chrome.exe 86 PID 1092 wrote to memory of 3784 1092 chrome.exe 86 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 4260 1092 chrome.exe 88 PID 1092 wrote to memory of 1388 1092 chrome.exe 89 PID 1092 wrote to memory of 1388 1092 chrome.exe 89 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92 PID 1092 wrote to memory of 4884 1092 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://c7.eu-3-id5-sync.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa358b9758,0x7ffa358b9768,0x7ffa358b97782⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1592,i,18170341402743917012,10281992724509848883,131072 /prefetch:22⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1592,i,18170341402743917012,10281992724509848883,131072 /prefetch:82⤵PID:1388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1592,i,18170341402743917012,10281992724509848883,131072 /prefetch:12⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1592,i,18170341402743917012,10281992724509848883,131072 /prefetch:12⤵PID:444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1592,i,18170341402743917012,10281992724509848883,131072 /prefetch:82⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4700 --field-trial-handle=1592,i,18170341402743917012,10281992724509848883,131072 /prefetch:12⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3200 --field-trial-handle=1592,i,18170341402743917012,10281992724509848883,131072 /prefetch:82⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1592,i,18170341402743917012,10281992724509848883,131072 /prefetch:82⤵PID:3556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4668 --field-trial-handle=1592,i,18170341402743917012,10281992724509848883,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:100
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD554939b6b5378d05d5238b157fb0368ec
SHA10409589774db35f53425e4c19879c24919bb82a4
SHA256e02d82a085f27cfddee93a5ec91f0e6a533563823c90447e8682ae7ddf1f4719
SHA512bf7e8509754a0299b27ecfd4b5eca399f6f2627dbd8f7d82337a3989b5c12c40da2224bb3fd3d34f00aea6f30d5b7411f55aafa19bfde0fed055d4970883941b
-
Filesize
6KB
MD5acab91564b835b107137cdebbee9710e
SHA1a756e4a97efd56e6edd15895daaf48b16613bbc2
SHA2565a9691fb994d1b1fbacfd9536d481b10e671d6cf901c6a3cb59c95a8caacdd91
SHA512a41c78f24bc9d0cdcc9d61973939098ab5207340d1f6f13dc52e845ef98e1a5e4b4e19a7dd54af826c01092bbd10dfe47a63998c878a5b95cf166a143cd5abe7
-
Filesize
6KB
MD52f2c5aa2e88c468c837ea5bf4fb77a4f
SHA1cdf1b3e5733e042cc7d0320e35534f798e92b29a
SHA2565641387730b133f36e5bc4348925daa7a2abf325aed550c9e8155beb9374022c
SHA51224a952e6284d89f0b79114e751ae3c0cdd46fb824e906e51a90a46cfbf1db972c66d220c41f34485b0b7f5c85f136af3ec61b35c9fc29362eb7366ad82d17475
-
Filesize
101KB
MD563b9a3db8b6addb47c4fc4156d11c605
SHA12d3da5ff6666588e4ffef3eb39675847e29f7704
SHA2563b35875477d851dd8a060cc75832378202461371a602d95baf3db16b4f79a4ad
SHA512ab5880eb72c230651a353b5b936d5bac44993f1ba13ee596f81997065e5cd48ef805301d5910eec1e997502e4047fd9d33ef1d91d59455e2d211d5bb73b6f18b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd