Analysis
-
max time kernel
165s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 14:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://truelovedatinghub.life/?u=2rek60a&o=y548kyb&t=serdat>Click
Resource
win10v2004-20231025-en
General
-
Target
https://truelovedatinghub.life/?u=2rek60a&o=y548kyb&t=serdat>Click
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133433244969948098" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3768 chrome.exe 3768 chrome.exe 1852 chrome.exe 1852 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 3768 chrome.exe 3768 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe Token: SeShutdownPrivilege 3768 chrome.exe Token: SeCreatePagefilePrivilege 3768 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe 3768 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3768 wrote to memory of 4352 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4352 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4624 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4232 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4232 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe PID 3768 wrote to memory of 4856 3768 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://truelovedatinghub.life/?u=2rek60a&o=y548kyb&t=serdat>Click1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff976a49758,0x7ff976a49768,0x7ff976a497782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1904,i,2539733884106528636,5820027105159707524,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1904,i,2539733884106528636,5820027105159707524,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1904,i,2539733884106528636,5820027105159707524,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1904,i,2539733884106528636,5820027105159707524,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1904,i,2539733884106528636,5820027105159707524,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 --field-trial-handle=1904,i,2539733884106528636,5820027105159707524,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 --field-trial-handle=1904,i,2539733884106528636,5820027105159707524,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=880 --field-trial-handle=1904,i,2539733884106528636,5820027105159707524,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD51ee231764018a75fbfd258e527d96988
SHA1e9b7b92f49ec6c6fdbd7ecbea0d0d3ad0a5d4e85
SHA2565e71633476bc558e20c9aedb9a72267dbcacee7fafe2444640f2470b425f6583
SHA51295f5bcb4a72946e76d06bdb483d6442eb2477436a75efdd2a6359172a90f35c8e55adf0e070464d2fd61579ac3e74f0178dd23fb3d759fae32dc03b3d65c8876
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD58b22a9f852e7feb9d85c178d7dfb3d03
SHA1aabf8b75934f6389ada24b07558bbbb8f37865c2
SHA25668e9bbb4954fdd786141f890e55197e47be6dec4ffbe607fb5ef5a6b6d3bc196
SHA51281c685eb78e4fddd2b4c35613d969c3a9569a4260b640ab7a601267aea6233b3635db87abc0b1b883e97a3b94d72a250c30222285d244753db047aa47451c828
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
706B
MD59724b1d0379b4c2daa3224a99c26b44b
SHA13bd65023c86b2bb821f8507ec433129d6eca82f6
SHA256804d5ea4ceff894947c474d1cd9da06423d7a3a5b8ef6e714a69e77b2463eba4
SHA512d875b2fb0cd154304df2c12a645994a1623b58dc11df2c75b73931d9ee6287e9aa91511c8fbf94f77e22dedb6313a6f391decc751ec2b686281d2ac064e9332a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
706B
MD52d8624f2187b4e286fbd76dea0d77b4d
SHA174bedd9134ce7107572b10e79e16ef20a124c6c5
SHA256eaa740a322388e4f21e1eef113a718ee446cc6ad52f2f432f20d84e3ed17abb6
SHA512ce820b85afee4d77405427ae76a37b6d7f909ef4d593fb16ba0ca1ebb562088444e3ad169e627a97c2c113a0c949fd134047d532c00fad4257bd96e8ee0fa7b9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
706B
MD5ed30e031262d3f745858b64a66badcff
SHA1d92b53ec03f4fe98d4e24ca2c36df3114ae4f33c
SHA25651dc9bb26c0f27ecad49b54aa0f3f529bd3f1dd42b854f6093d65b010b206c47
SHA51271798f75805315488611c46d8442900e67768e304f1fd4150815fc4584f6f05f53369130538800f308ee8097e6b2c9e2fe429b85c25776eab81104ecb10a0fdf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD55fe3cb6a7174465efbc482eefc67df7e
SHA1ff27b7e01395c4d6fb3a7d292ccba91f067207db
SHA25635f656a376e651ccdd0e2c9b61b2d75b984b7d7574d31eb9fd0d1973ce8628fa
SHA512573f75368866a16bfeb38aa15843b905b8c3bd9b95518e3322cc8ea7144aaee68fdf4e0aa553f88053898544ed13f1c1bb81cd9bf1b8e8fe54247897616eb785
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
109KB
MD589ebd5660042c9361fb150f54a304ce2
SHA1a4829aaacce02c4d9a57270e5cc1414344a97265
SHA2569479e58babd7503f053ecc2624f4148ee5b5ab1acf3003a69b4bcf3d5a9026e3
SHA5128a641d6689a71411656f67c90a313f16f8b04edb28d7af28b696a15d3a29faf29155d9b617d68d0da695c3b1faaaa2a452cbc090392e9f325980bb154dca4a8a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_3768_LTYPIHQNGZGEMRSUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e