Overview
overview
6Static
static
1URLScan
urlscan
1https://checkip.amaz...
windows7-x64
6https://checkip.amaz...
windows10-1703-x64
6https://checkip.amaz...
windows10-2004-x64
6https://checkip.amaz...
android-10-x64
https://checkip.amaz...
android-11-x64
https://checkip.amaz...
android-9-x86
https://checkip.amaz...
macos-10.15-amd64
6Analysis
-
max time kernel
305s -
max time network
1688s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
22/10/2023, 20:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://checkip.amazonaws.com/
Resource
win7-20231020-en
windows7-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://checkip.amazonaws.com/
Resource
win10-20231020-en
windows10-1703-x64
9 signatures
1800 seconds
Behavioral task
behavioral3
Sample
https://checkip.amazonaws.com/
Resource
win10v2004-20231020-en
windows10-2004-x64
9 signatures
1800 seconds
Behavioral task
behavioral4
Sample
https://checkip.amazonaws.com/
Resource
android-x64-20230831-en
android-10-x64
0 signatures
1800 seconds
Behavioral task
behavioral5
Sample
https://checkip.amazonaws.com/
Resource
android-x64-arm64-20231020-en
android-11-x64
0 signatures
1800 seconds
Behavioral task
behavioral6
Sample
https://checkip.amazonaws.com/
Resource
android-x86-arm-20231020-en
android-9-x86
0 signatures
1800 seconds
Behavioral task
behavioral7
Sample
https://checkip.amazonaws.com/
Resource
macos-20230831-en
macos-10.15-amd64
1 signatures
1800 seconds
General
-
Target
https://checkip.amazonaws.com/
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 checkip.amazonaws.com 4 checkip.amazonaws.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2872 2664 chrome.exe 28 PID 2664 wrote to memory of 2872 2664 chrome.exe 28 PID 2664 wrote to memory of 2872 2664 chrome.exe 28 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 1616 2664 chrome.exe 30 PID 2664 wrote to memory of 2828 2664 chrome.exe 31 PID 2664 wrote to memory of 2828 2664 chrome.exe 31 PID 2664 wrote to memory of 2828 2664 chrome.exe 31 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32 PID 2664 wrote to memory of 1640 2664 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://checkip.amazonaws.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef74c9758,0x7fef74c9768,0x7fef74c97782⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1364,i,11234084912034332200,4781635004200095341,131072 /prefetch:22⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1364,i,11234084912034332200,4781635004200095341,131072 /prefetch:82⤵PID:2828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1364,i,11234084912034332200,4781635004200095341,131072 /prefetch:82⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2240 --field-trial-handle=1364,i,11234084912034332200,4781635004200095341,131072 /prefetch:12⤵PID:2696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2252 --field-trial-handle=1364,i,11234084912034332200,4781635004200095341,131072 /prefetch:12⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1404 --field-trial-handle=1364,i,11234084912034332200,4781635004200095341,131072 /prefetch:22⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=1364,i,11234084912034332200,4781635004200095341,131072 /prefetch:82⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581e2a66f9f50f3eb9583e1a619f7ac49
SHA1d5cb32416751085db09df9cb55b74dc8a86f5471
SHA25682dd1620a8955f9336093d0c4dbff52602c004db0a7659cec21497930b1a7951
SHA5127690e2341f891fda0432287739ac51913a9dcbf3220d2784d4b32c25a019d0943456b1717636b60083c92c968ca2ec1ebea7105b62a6d3794e951126cd67cb37
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD5447edd656dbe280b16d33c75beb22e8d
SHA148fd8268026febf427ab17e44f32e1c173800d00
SHA2561064efb64a122b6fa3ef17e76e3df212c50c81b85e7a02baed2569bf0cf34f74
SHA512323edda77ffdd411ad6248aeae11634cd4353195bdfc7efdcb304e8f47fa9e9fe2842b80ca82295b03d049468f3f770b019e5841fdcad8ddadc02426bfedc196
-
Filesize
4KB
MD51ea5a027f00e638f7570891748845032
SHA15d030dd584d8ed18f16f64f06e19a6622db2cec5
SHA2567a87a467b4905f0f781978a43cc7278d15db5255e795917c54143228bcad979e
SHA5129739a3ed820f9340c3db84354f3251f78c1443b64fd16826806c33e96ef44e15f96e219b7b8e1a43ad21059c33adc699827247e74a973c16a82752b9249a4ae7
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf