Analysis
-
max time kernel
601s -
max time network
491s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 15:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ipa.ipasign.cc:2052/download/a2dfd0fb-c83b-2f6a-9f54-c1c711aa4f7e/20231013042957141
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
https://ipa.ipasign.cc:2052/download/a2dfd0fb-c83b-2f6a-9f54-c1c711aa4f7e/20231013042957141
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416860380429147" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1696 chrome.exe 1696 chrome.exe 3244 chrome.exe 3244 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1696 chrome.exe 1696 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1696 wrote to memory of 3416 1696 chrome.exe 69 PID 1696 wrote to memory of 3416 1696 chrome.exe 69 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 4772 1696 chrome.exe 90 PID 1696 wrote to memory of 1332 1696 chrome.exe 91 PID 1696 wrote to memory of 1332 1696 chrome.exe 91 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92 PID 1696 wrote to memory of 4308 1696 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ipa.ipasign.cc:2052/download/a2dfd0fb-c83b-2f6a-9f54-c1c711aa4f7e/202310130429571411⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccb4f9758,0x7ffccb4f9768,0x7ffccb4f97782⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1676,i,10202570718800388617,6455038353448300706,131072 /prefetch:22⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1676,i,10202570718800388617,6455038353448300706,131072 /prefetch:82⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1676,i,10202570718800388617,6455038353448300706,131072 /prefetch:82⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1676,i,10202570718800388617,6455038353448300706,131072 /prefetch:12⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1676,i,10202570718800388617,6455038353448300706,131072 /prefetch:12⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1676,i,10202570718800388617,6455038353448300706,131072 /prefetch:82⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1676,i,10202570718800388617,6455038353448300706,131072 /prefetch:82⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 --field-trial-handle=1676,i,10202570718800388617,6455038353448300706,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a13870d1ef934a642c0702ff0c265df3
SHA1f5c1f1480ece2b9fcc1ab29e1fd4a0b384590ca4
SHA256910fe9e5208a5bfd08e3335e694da1de3abae1653ea6be69939e508f039e0a37
SHA512ee956d426ac31aa0b3099e64dd8f6d9e8beb4860af416aa18067b24f6a23ce1d2c7b9545f3b9bf5eaec607ec7d59b608508c55fd609a54080816cb455cdcb254
-
Filesize
6KB
MD536ff92a9eea13df171e935e73e9e67b8
SHA1cc6682397bb10020be9a0623130c5769bed81bdb
SHA256145aec000a3d007ffd8839f4910eacb01dfcb31db8e820feac50c9871109e5b0
SHA5122701454002f85459b24fb9b4ec766e1df835ef954d4a487366dc6f2ba3a44a9ef2eb0f893e9068e3fb7ba118107ddc9f09309d87a4db61f506caef9f1280c8fd
-
Filesize
101KB
MD5666ae8326b8f0388496f41d15b964ae6
SHA175920b8c645294869d0e39b212e7b4961aae3a29
SHA2569571b9dadbf56049d424f5284030d15cc48700fefbca11ae37361486de887fe8
SHA512c33d271af6032096873fd95fa489d95096e207bfa1a60c16ad410c0cd40db16a21b414142200a3ca619b4b588ba746869c72ff4a38467810b52a5fa354b15bb0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd