Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2023 14:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.commonsense.events/events/nl23-akamai-security-and-trust-2/
Resource
win10v2004-20231020-en
General
-
Target
https://www.commonsense.events/events/nl23-akamai-security-and-trust-2/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133443585269921075" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4396 chrome.exe 4396 chrome.exe 5500 chrome.exe 5500 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe Token: SeShutdownPrivilege 4396 chrome.exe Token: SeCreatePagefilePrivilege 4396 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe 4396 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4396 wrote to memory of 448 4396 chrome.exe 74 PID 4396 wrote to memory of 448 4396 chrome.exe 74 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 3932 4396 chrome.exe 88 PID 4396 wrote to memory of 312 4396 chrome.exe 89 PID 4396 wrote to memory of 312 4396 chrome.exe 89 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90 PID 4396 wrote to memory of 3240 4396 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.commonsense.events/events/nl23-akamai-security-and-trust-2/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a9d29758,0x7ff9a9d29768,0x7ff9a9d297782⤵PID:448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:22⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:82⤵PID:312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:82⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:12⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:12⤵PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5036 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:12⤵PID:2904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:82⤵PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:82⤵PID:5180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5500
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1569cb3a-4c4a-4942-8950-f6e69a4b7ad6.tmp
Filesize6KB
MD599d8537078c0191f37dc20b8bebefe98
SHA19bc94ea2058f4bd0a79c3037404476663fa06a6e
SHA25638d193dd85d423d328812aec2ebce7b8f6f9c1b2c69f5fe18b180ccca08c5745
SHA5121b2cc92b70a347d5eafdb0a1a79529ec252a481995cdfe96fe1bf6bd38b1e9547edf16c520e7470b4c3b47c325b3063fc5ea09b092577937e34444a7bb44d12e
-
Filesize
186KB
MD5740a924b01c31c08ad37fe04d22af7c5
SHA134feb0face110afc3a7673e36d27eee2d4edbbff
SHA256f0e1953b71cc4abbffdd5096d99dfb274688e517c381b15c3446c28a4ac416e0
SHA512da7061f944c69245c2f66b0e6a8b5a9bca91bda8a73f99734dcb23db56c5047de796fa7e348ff8840d9ac123436e38a4206408573215b7e5e98942ea6d66bb7c
-
Filesize
888B
MD52c7e4db3eacfa8a4eed92cc7d4ca5e0a
SHA103c222ae33026c25a8cca9720bfda5f31ac59da5
SHA256ef272b10ab024bfd675002d797992f01c8bcec6adc49fe905cfa51a63efd9730
SHA512f1da737d0888fd63bad5ab1c3c91e4247279258c825cb4baf0528c37b46f6aa94bb96df5fec54697258b9bb3cbaf464e2d5ef232901413fe26a0ac0e5bf6969d
-
Filesize
1KB
MD53a0c9e51cac9166682a8f1905bc6dd9d
SHA17027c6320405999a5bfc20899530fe68246fead8
SHA256bdc6cec7eda22e64d291ef06c7a92235c7e9ce90e2a3ac63e83e1d7b7b117e86
SHA51233d428d129615d672cd7f2ff1aecc1bd7d7dd87042484e5d874c1d6e13207c0a86d977e993533f42eaeda09b32d5a2c6658aeaf112359599ae8d0f4a87ce0852
-
Filesize
5KB
MD52f6ea13cf9ea201cd4883708005c5359
SHA1eb9525a35ea47cb65a9e80e9bfe677b4c68ccc51
SHA256e9b5500846d9c4ca346951b83ebd19b15169937e8c94f6ffb98c9971bf622711
SHA51241897ff9bbfb23426c58647daf204ef2025370ddbdba31fb8c3c07d1862da95edd49483b0213e0c24487fba5ca2d3e52c704217f37e28b93b5b526446b2c8e9e
-
Filesize
2KB
MD5cf068f916cfc68184def9960cca79034
SHA11c295238650fb48eefcfa226c80fa1da566dd51a
SHA256c70c94b1d6e9594b84aec9c9d34c26b2cadb5b66f0b20cd53ca6a15c2c7da161
SHA5126250adad03ab073e0a84d5cc212405e4bc7f3a9422a84d62564a0698d80a80cdfd5e6acc3ce11df042659c0178ff1c0c051039b6f15ef0f4652eea823ff46a87
-
Filesize
2KB
MD5447016687d0cde154980fadd48dac450
SHA122450c49385a3b885af7114e19e445bc84638889
SHA2568e873e9dce3ffe7251cfa007b7b8d3bac5f8d6d3ba754a4b4275c1e9a7eb1625
SHA5124fff26855692870d463f352f6a7f521a10a893833267899c161baacb458c325241bfbe17db9d60dd26e1f0e77ef09d5d5c8c4d59846ee84a60f6f5b0e885eadb
-
Filesize
2KB
MD5ce992054893cf023027677e3a4d82ca9
SHA14f84eea88885a59aecc03e6195f0b91d812ab07f
SHA256d1fb678afd280afb0873715a6e5c5ccc095799925d60064dfa3b2ff7f89f7fce
SHA5127d3d7444f65d876d0ddc70ba03f427acdde9fc53b6bc7946e37a03b8d0289d2929f6c17256b6d8e1578c87f18f6015819b506148f3f5bd16d9e1e7bab85901b7
-
Filesize
109KB
MD5e4fcd2c9b80e19779323f2cbe6c4ce5a
SHA1ceccfb663a6e20ac2d1b3245a46fb93ee2db0f0e
SHA25671cc64e373cec9db8ea1874425f7cfbffe40b8a0db56a6defd18a3d9b087767d
SHA512436ba99900d97f3308b260927d4e4ff66f2d44dcf1ea8feb41a29bbf3766a24f4ae182e3db8343979cca01941c9ea5bdacad8e9b194626aa3734764d6efe77f5
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd