Analysis
-
max time kernel
1800s -
max time network
1691s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 22:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://h
Resource
win10v2004-20231025-en
General
-
Target
http://h
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133443008845700207" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4072 chrome.exe 4072 chrome.exe 2392 chrome.exe 2392 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4072 wrote to memory of 2656 4072 chrome.exe 14 PID 4072 wrote to memory of 2656 4072 chrome.exe 14 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4648 4072 chrome.exe 67 PID 4072 wrote to memory of 4556 4072 chrome.exe 74 PID 4072 wrote to memory of 4556 4072 chrome.exe 74 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72 PID 4072 wrote to memory of 2648 4072 chrome.exe 72
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9e569758,0x7ffc9e569768,0x7ffc9e5697781⤵PID:2656
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://h1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:22⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2824 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:12⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2796 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:12⤵PID:2448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:82⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:82⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4800 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:12⤵PID:2712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3060 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:12⤵PID:2372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:82⤵PID:408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4968 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:12⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3084 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:82⤵PID:1740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4900 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:12⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3964 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:12⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4428 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1844 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:12⤵PID:4084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1648 --field-trial-handle=1876,i,4579890550718337958,16797045069487306566,131072 /prefetch:12⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5759c40b6dd9b19639573e874b845edf0
SHA12e028a8871a6d1f0e3477e095dd862a186ee44a6
SHA2563f93f69f39af15f6956452977da823ca785e2319d17d9a250799dd7467229e92
SHA51286214c86342c8344d103b43a6fe8c6ae112d98e3c878e7212488c55b03f217879e8232441792d917a1f51bb0632150401beb32f9f3cde65613df088f8f803f63
-
Filesize
6KB
MD59ee3cee028c05b3db511e10c8d3296ba
SHA1c7989b07e2b759591c8e889e943934da2f15801d
SHA256d386ef7ebaed9f3a0004667eb37c5bc8001dc34a930d017875e1c90c26413621
SHA512d3c190bfe509651b7a54e9f71b50bf987a49b94faca08fc81eda2180561348ff2598037c3919fcd39dc5f7c8306aa21112b0f646439093ac4a2117b0b6531988
-
Filesize
6KB
MD5a50ee243b6fd6af22d6fd94f44e1ddb8
SHA1f9bdcaf3609de05f16f96a28797efa07e36fc063
SHA25697394a16039aef7f93c4f8ee35fec2b606a91ecf1a2a487a3fed35cf11cd020e
SHA512def7ce7a9fcd7c8256ead5973569a2caebcd2dfafc060e461102b5e8b444931114140f6659abc7ba16c0bbed5d274e01f8a23b220be4c806e81290aaa776f818
-
Filesize
109KB
MD5c0ce215848d0b82a13416669b7659378
SHA16c6f03be2eb4179510bf5c41a7ae697c1d1d4772
SHA256d63d57788a5b94f15aabb1459fb6a8e42e1dffa3ae3347971922b56f8a229a29
SHA512ade008b8923af8a2b748c8f5b5c6aebdb5224baa7bf5b7f3db2f3436168e0bc7ca17f4231ab0b8f746bb7fa20d1ae3e4a2146ac9d17d08a104fa455dfcaa0b91
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd