Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
24/10/2023, 05:48
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://121.240.11.41:83/Message?action=Release&mid=116775&email=beijing%40mae.ro&h=IlR%2FosxsSxCtim7jw8AJFUB1OXt42%2FN%2BWmLV8lJiNCKt%2B%2FqLXoHRaEAFtuOnYXK1tEar7Tr1aSRf6G2%2BXVBtuHO6uBrlyTvr8QvOYm1F0C4%3D
Resource
win10v2004-20231020-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://121.240.11.41:83/Message?action=Release&mid=116775&email=beijing%40mae.ro&h=IlR%2FosxsSxCtim7jw8AJFUB1OXt42%2FN%2BWmLV8lJiNCKt%2B%2FqLXoHRaEAFtuOnYXK1tEar7Tr1aSRf6G2%2BXVBtuHO6uBrlyTvr8QvOYm1F0C4%3D
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133426001406446981" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3144 chrome.exe 3144 chrome.exe 3480 chrome.exe 3480 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3144 wrote to memory of 3284 3144 chrome.exe 85 PID 3144 wrote to memory of 3284 3144 chrome.exe 85 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 4264 3144 chrome.exe 88 PID 3144 wrote to memory of 2100 3144 chrome.exe 89 PID 3144 wrote to memory of 2100 3144 chrome.exe 89 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90 PID 3144 wrote to memory of 4568 3144 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://121.240.11.41:83/Message?action=Release&mid=116775&email=beijing%40mae.ro&h=IlR%2FosxsSxCtim7jw8AJFUB1OXt42%2FN%2BWmLV8lJiNCKt%2B%2FqLXoHRaEAFtuOnYXK1tEar7Tr1aSRf6G2%2BXVBtuHO6uBrlyTvr8QvOYm1F0C4%3D1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec3809758,0x7ffec3809768,0x7ffec38097782⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:22⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:82⤵PID:2100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:82⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:12⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:12⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:82⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:82⤵PID:1452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3996 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:12⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3100 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:12⤵PID:1760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3784 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:12⤵PID:1328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4056 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:12⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6008 --field-trial-handle=1840,i,11753956017752671604,14482177826468552682,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c5097427ae5060211b620dbfaa63d432
SHA1cee48e001c3415ff28f821d33d6f87d9482192c1
SHA2560c20a66e8b4ce8fd224c552acd480591f842656bcd618b9d00f5cfd5c6fd6f26
SHA512a34c35a5d34085a1cd9d16ffa255c3748d90364055f78da8162cd791cdda44539e66810a351d1689b6f7eef67a27c90802beb57fe0d1ddf99d710bd5543e6360
-
Filesize
6KB
MD5fba9228a54a4b347996a929eaf2a17e9
SHA1fb91741f244be2f19ad8257bb81569f62560beeb
SHA256c90a728d344bf5a624c97c41c597b412c8d278d730bb06072a09fafb7d0bd748
SHA512d0041ee885dec88b8687386e6dab6c408975203a3df191bbb9bec67e6610116bdea1badfe995cb8081c691ed08f32d58360c3bb71adbc002e88036e0805c431b
-
Filesize
6KB
MD5254c06e8387f4b281b6989d87a83483b
SHA18b23369249b02f33b1385698a0754c2ee7ae7cff
SHA2564bc1e9f96a7a0668c97155a89c118296902d4cd075e79b84ce598c70d520f151
SHA512ba0e4cc9897a681d0ed7b95e8757f99b37a011cba357b1f4cc826d80c9d23ccccb80730a814d07f13b43800527c501cbfa5652f0b14abceeaf0e45d254e536a2
-
Filesize
109KB
MD5f434c255027ad8395740739adc968b8b
SHA1a171fff45c84fba5bfe340bd9ce7c7f1dfe8b40c
SHA2566fe10556c12f16e7d1265ab05960ac069c7d28bd47818d6dce92196058a32a20
SHA512474f7687bed2cc889de59954eaba5c40ec49123ce13b9fe2a23d0072a20e9cc05ca6c38b986ec6ee82831ff8c15f757357b4a971046838f7aade84b92a620b3f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd