Analysis
-
max time kernel
153s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 11:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://uniqueeximsolutions.com/dgft-dgft-hq-services
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://uniqueeximsolutions.com/dgft-dgft-hq-services
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416704282775183" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5108 chrome.exe 5108 chrome.exe 5008 chrome.exe 5008 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5108 wrote to memory of 3824 5108 chrome.exe 65 PID 5108 wrote to memory of 3824 5108 chrome.exe 65 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2056 5108 chrome.exe 87 PID 5108 wrote to memory of 2076 5108 chrome.exe 88 PID 5108 wrote to memory of 2076 5108 chrome.exe 88 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89 PID 5108 wrote to memory of 3580 5108 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uniqueeximsolutions.com/dgft-dgft-hq-services1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5acc9758,0x7ffe5acc9768,0x7ffe5acc97782⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:22⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:82⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:82⤵PID:3580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:12⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:12⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3928 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:12⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4744 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:12⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:82⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5072 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:12⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:82⤵PID:3632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4648 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:12⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2840 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:12⤵PID:2772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=884 --field-trial-handle=1868,i,6239385552720006905,11876972983696106096,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5008
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD526a2e9ed501dca2ae99e696480ae39cb
SHA1870e6822c1550e7febefe746f426c8e0a1bfd4ac
SHA256941a9685db43a83f0dbe8e746605a76fdf39fb5e0713ff0f93c07fb484a8a791
SHA512942c24ed91af41855b958e7b1991ca26340dc16cba548538913412f6f1a3373cfcb736bac78dbd61417a822e4cfa1c3874afaf494704b9edbb4f571f2c837bc3
-
Filesize
6KB
MD5ddf75631a2dfed18c5968c2ac9b4c1a4
SHA1c69f6aa57ce6ad7ba578757165b91596815f0640
SHA256b686a463cd09d4b4c8d79ff1c18ab18d37feaa6165d16dd731d42c65ba9780a7
SHA51242c3459747d1d9c265d3fe0fc68a09d62c72c676037dc381fe48062d53b175dd7236ebf5e823dc1b7692ce0e674f5008d14cc17448c71f7377a41ea8037f1d9c
-
Filesize
6KB
MD592817c0c6fd0e00a974fd25fdd236968
SHA15d5c0fe439218767723635c6ccf6ba96faab8c7e
SHA2569d91d5b740620b57d71716c55078a797d6ddfb67b336f395f80813d90796624f
SHA512ccd533eefd5aecbf487dd76538b113f086972a3955236a20324d8e2dfb492983c433f5b86aa0dfe12fe39b2032ce587e1321ba7b109371dbf16add1545e5c854
-
Filesize
101KB
MD5ee37a298f5aa0c8da508dbc8780cc4fc
SHA11d3c827777ee24267091f374635ced49f9351340
SHA2560b19edf2f3dfbafc961f531dc59291ac10ca931661eb288848058b9690f9436d
SHA5123f78ab905dd95af413d9b07accee3358c7b0baab9f02d4bbcb1f623c731a8d52641b3481f86911384b1c40e7b1a3670aa872eac210419eaa4a9e93887b308a7f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd