Analysis
-
max time kernel
65s -
max time network
70s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
02-11-2023 07:40
Static task
static1
Behavioral task
behavioral1
Sample
Play_Audio_Message-00-49--00.htm.html
Resource
win10v2004-20231023-en
General
-
Target
Play_Audio_Message-00-49--00.htm.html
-
Size
459B
-
MD5
4f4226cf4f24920bb00acdadd635efe3
-
SHA1
7d9d227c83c8a2b486375c9d622b68227133294a
-
SHA256
3d4173165b63ab130d650a331e9289e6cf3fedfbab75514f5df0ba8df611b2fe
-
SHA512
4ab50ba5168e3f17b6ccda4737b2c2bfaf40b958807e9d70765c81247354b9bb0da1a5b133ffd9f0492b41d60f4843e118745b890f0b68126bd49b2577319bc5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133433844416436541" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3912 chrome.exe 3912 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3912 wrote to memory of 3400 3912 chrome.exe 84 PID 3912 wrote to memory of 3400 3912 chrome.exe 84 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 2628 3912 chrome.exe 86 PID 3912 wrote to memory of 3968 3912 chrome.exe 87 PID 3912 wrote to memory of 3968 3912 chrome.exe 87 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88 PID 3912 wrote to memory of 2116 3912 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Play_Audio_Message-00-49--00.htm.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffded89758,0x7fffded89768,0x7fffded897782⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:22⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:82⤵PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:82⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:12⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:12⤵PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4540 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:12⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4592 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:12⤵PID:2328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3988 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:12⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5264 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:12⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:82⤵PID:828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:82⤵PID:740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5188 --field-trial-handle=1880,i,4124023984479140498,5670237310320313614,131072 /prefetch:12⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD5ae55c712daa92cc8de4745dc2fe88c86
SHA16622427f1a87747fe153546b3188593b232ef951
SHA256abc75f52d135732e0f8a724815c91a044915fd7db9a3a9445931c98e7e7a13c7
SHA5126168769ab353eaf94f0e4a29d830c0b37cf521467c1070d6dac79659173c6de10c023222bed2d89642f3db8223480e50ea08070cf54689ae7fc6f9bf55f452e4
-
Filesize
120B
MD5d6048fc9c207a0384390ae18a7005a9d
SHA135c56982ebb7aaea60a8d5207e57d60dac02a92d
SHA256e3ab441cf52f8f996d89818dec8c8448e3a0570f76355f8453fc8dee0d64ff18
SHA512b436fa71fe063b82a8f6cf7069c6ee096a4ae2f495543237dd2fb32534f94b3967b0ac7cb7516410ac5598aacda09b8daf65aa6000d7a57ed4bb48f84599b078
-
Filesize
534B
MD5f079d782f45dfd3db49eedbe410c2325
SHA1e8c3d495fba2fc83d1d01809f091302898ed615c
SHA25647500d6b50246cb65b12de08dba431f3ae0d0c355a5f519d2bee53c3e3f8bdd4
SHA51215c7acff20132498d189f65bf07d3f7ad4587c73cfed286b3b13936ce952650d81a2e698e78f53f89bfb7e8e761b31877080449dd2dee0671ad505a3be0768ac
-
Filesize
701B
MD5b2a8aea98bb784f968d87457c69e129e
SHA1fdb28399101d16968d881773ba2a709d78626f0d
SHA256f9fc6baf9422ca99d5cef7fed4348fda050568632b567a898ea197cce5aea70f
SHA512432e78369468f2b97e9cb594e847b036be4c86fe089333b66721be241796fce6e4a008d1bc92f095b4295bb864bc26c4cdeff9f308ed2d67cf9eb15935548e7f
-
Filesize
5KB
MD5111b97b2e0bd21b105381942e6ac25aa
SHA17b2fe554f2cd1c39a39579b45cf2bfe2a52b63ff
SHA2568d6c1fce7109dc77994aefe8b2dcd78f255b059aeb1b74a490cdfd6c486c5b51
SHA512a02ce22728e8305c79f8ccfaf0ceca0451290e14acbc2dd2fc61ad660df1525cdb8b13e0e36955e77493b0e99890cd02fc80dc50c66c9dbe627ad3d7cc5806ca
-
Filesize
5KB
MD5ab437a84c889d143ec53ea3475481a33
SHA11a7410212440722080b0608905aa75b0745b2d78
SHA256c9b231e3ca0f55965f419d92b1ecc6e555659294e1039ba85ec4aa93a1280d3b
SHA5128f2fb2423bbae1eb3ffc0c052c1167ee8053c5175bc6b35159c325957172f305f408ed856a90488d4139852824904bbd200d70d1e9c575a524f586633593be0d
-
Filesize
109KB
MD5bb4de38222ce23d3ea01eea82fb6b645
SHA1b23c00d672c464c705d02132249f9a6bd5e1cbde
SHA256334989743d15fe8718ed006e8c0fdb00a83f93e7f65ff039a3460a6f2a180446
SHA51257bfe0eee47f132d55b3f3f1a1fe675364db651c18223681732c8fd9bf30ff2b24b240dfa9c0b911d17426410fa0c51ca7d6225f00ac798d8156bbfcf9b203c9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd