Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 23:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://aus-taxnotices.info
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
https://aus-taxnotices.info
Resource
android-x64-arm64-20231020-en
Behavioral task
behavioral3
Sample
https://aus-taxnotices.info
Resource
macos-20230831-en
General
-
Target
https://aus-taxnotices.info
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133424928341541351" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4516 chrome.exe 4516 chrome.exe 4812 chrome.exe 4812 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe Token: SeShutdownPrivilege 4516 chrome.exe Token: SeCreatePagefilePrivilege 4516 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe 4516 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4516 wrote to memory of 3808 4516 chrome.exe 51 PID 4516 wrote to memory of 3808 4516 chrome.exe 51 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2620 4516 chrome.exe 86 PID 4516 wrote to memory of 2936 4516 chrome.exe 87 PID 4516 wrote to memory of 2936 4516 chrome.exe 87 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88 PID 4516 wrote to memory of 3560 4516 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://aus-taxnotices.info1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff874569758,0x7ff874569768,0x7ff8745697782⤵PID:3808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:22⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:82⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:82⤵PID:3560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:12⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3140 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:12⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4532 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:12⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4912 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:12⤵PID:1984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4864 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:12⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:82⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:82⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5516 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:12⤵PID:780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4500 --field-trial-handle=1824,i,5433962325320829302,14047868788872564764,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4812
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD579c826b223acc141ef4ce8d9ffe833c9
SHA11fc018e27f73f0c5a0acd1078afab0a0c556a71a
SHA2562201b51b3c37e331c6f13edc732852d1521c766b72a096f7b2ed66fac822749b
SHA51208dafddb5a20360b29149b2a08608327ae14d996508f78f07c63ecf4276bd47cf8083c7f5c7e7739e81aaf34d656e22fe01a6ab0e620a946e939b38c04245547
-
Filesize
2KB
MD5303aee8a4a8435a750df59e54985f21f
SHA137e86064fc9006c3b188ac6ff2d9a0baf967cf31
SHA256deee7b218c14b61bb22ccefad30fbc66426e2abb2ae3c7af5454a94253bcfd1a
SHA5125a0cbcc0ad05480018d77bbf79aa816632150fa169720286b9ba5ea741e92a54f68c279ed55b4e807ca292c26a83cc4a9416d6eefbdfc4ac005cddaf423c2593
-
Filesize
5KB
MD5180bad0674ca865216709b4db787c91a
SHA12d596dc6fa22c4aca5c730ff9fd7869bd67512a1
SHA25608ec591aa693f2280901ac447c7f660ba1d6d100530382e469c80d8f85401c0b
SHA51210fc6d3760b761cdbf637b1024d562d271a538bda23d0ed34f74f73859d8cff1ed8290daae2ca6eea6bc1445b55ad6ceac5266593b738f51a1feb659e48ebd46
-
Filesize
5KB
MD594469db8cdc112dc0c56a246bdb9cbde
SHA134154ca2314c61941712efc99081421996c008c3
SHA25641f7fa712f362a42252d740fddd54117f17f974ea0de14a9f2a98196074d218c
SHA512280e087281490fd94169ee027f9a5ff9b3c8abf9a1dcddf7abd3cd4e1e42464a66520d295bae3d91d20c1bb38d671f10d7e7a3159b6666b9878ba9f44d5a9f44
-
Filesize
5KB
MD59ddc1fcfd21c12de570894c8a90d4c0e
SHA1971923b416809c3bc450b61c553e5e54c095f770
SHA25679c8a3f02392b169fe4deaac14a01e5528f46cb21cd3fb3c8f7a5a8211fad179
SHA5127d5a2ce5e287f74f38cf93ff121057e2b0d6cd3a0f992b0118ce81676ced857992964ab0b3852154a1b52610e2c348a642c5c8078200bd17199ddfbfab67d329
-
Filesize
6KB
MD545c32f474df57653d12ee703d19ee854
SHA1b0e039d52b72aec5a4f427529ca43faa79760434
SHA256211ccd2eb88e0bbbc072577b33e47e6734d247d77f88a24e51e937a9d4a5fdc8
SHA512beef78a73ad32f50a01293d224371d53244de79d59b99e631602b3ddf29bfa2a7d753c7fa2900a51973ab722618306258eaa59162586f590bf88c24e82e24ffc
-
Filesize
109KB
MD5ba601f29275eeb8ad8f51d37cbae2ed2
SHA1e432ed117fe6557ef0e5199ae6109c5dd441ba0b
SHA2565d882508e795dc1719f9dce24060e546c2cf8907552f270a0355cefc844feaa7
SHA5127c025afbb4cdd2cbc9d1634601614e9ab96501b067796decce818b106993be2bc6ba4e23a3479e44bc4da6f551347edb2a280301c55732d9061b234223958bb1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd