Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 21:22
Static task
static1
Behavioral task
behavioral1
Sample
hpinc.com_.html
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
hpinc.com_.html
Resource
win10v2004-20231020-en
General
-
Target
hpinc.com_.html
-
Size
273B
-
MD5
1dcb8cb82db8422f541c6fd4d702abab
-
SHA1
7a52ba7d82d266827a2fe902022c6ce11b7521a4
-
SHA256
c136130248559e8d39cc067a53fc9f95c80510a4d934dd177a3ceb0676035d09
-
SHA512
689bf37a72b700007c1b55dfb3886a1d5cdb9a1e4ab91afbad7509827d92703bf20d71e0aa842f8ba27515501ef169417063fa9944a98a8777f9dd9578a2007f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133443841943153956" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3940 chrome.exe 3940 chrome.exe 4400 chrome.exe 4400 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3940 wrote to memory of 4540 3940 chrome.exe 84 PID 3940 wrote to memory of 4540 3940 chrome.exe 84 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 2816 3940 chrome.exe 90 PID 3940 wrote to memory of 3532 3940 chrome.exe 91 PID 3940 wrote to memory of 3532 3940 chrome.exe 91 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92 PID 3940 wrote to memory of 4012 3940 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\hpinc.com_.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99e589758,0x7ff99e589768,0x7ff99e5897782⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:22⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:82⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:82⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:12⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:12⤵PID:1760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4500 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:12⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4744 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:12⤵PID:1048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3020 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:12⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:82⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:82⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=820 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD596057434b0cb713e41a2268d40e7a930
SHA168a7d393befe37dbe3017653dbe02e25f749b5de
SHA25699fc9228a93ea980e2203910225d340d892773334fdae3f6e7e6e99d3511abe7
SHA512a34cc24a10f9c44e754ad1b59956039a8cecc3634df941c0c1cae9aa8dd210e3b44ce8ff1e56626a6ff6c3ba2efa6cc732883f414a45f187ed2a6b024804bb5a
-
Filesize
2KB
MD5b19d6461349db1bdb20ea8d6586b1ad7
SHA15ae6443d02c95db926f53d552417976a3a2c3b30
SHA2569fe9be54d54338857e054b7e84a501302e499bc6cc2ee35b5fb8ccb7008396af
SHA512b1f9b647b37d53b872fc60113f33c203bff9aa37df6bd2387377f1ab2aea8715e53875ee301ebafaca837b21b5e400ea2fa8281d0611355ccbe9a1e687d0473b
-
Filesize
538B
MD5761326fde25a9151ea994dac55952f02
SHA1be11399ceb73cd6754586d565e12f50021a2b10f
SHA256ef2d6eda898def9f082464115d4809b3464bc9c913463e64fb059bf4a89947c2
SHA5123879cad1d77e376a69ab78b60e268e2a72c11aa3a551b8cbaa4fd7a0d1e3366aae9a48d36e2a88f7b4bcf38304c27b34020633fbc21bf157abbfa2c6e10fd330
-
Filesize
6KB
MD5f59c388a997e96bf42e9aef624c81816
SHA1cb47afb0f3d7bf993c4bc8e73ec627cd6f5b5030
SHA25696cc86254282a2310fb3e1e013a74295f1cb73e9c44843b3f6dbbaaa9eee6c2a
SHA512a96dbcb526149f25c71fdba5c65b4c90596b09fafb1e203208beef8fd68a629ab42c92da3a1cccfa6692c190a2bf61be8ace7ee8d6e5c87ca0a8b6c711117208
-
Filesize
6KB
MD5dc9ccfee01683343a9a1a09a8be08450
SHA1b329616f8ddbac8e326b9daf24a263b55863e57e
SHA256ea5336cfbc0e7649174eb3c30c1d4323f1483cd8023070082c25679d7db43810
SHA512850f88d15d42afe16c8cd7268504aa9889de29fba902a19b7f2d62b777cd6d82aa2d1cdadbcfdd27fe1ebd468d7389845d14e779b0623a5c4baf23d8ff4a79e0
-
Filesize
109KB
MD53271ccb539f36d0d9f43ecb7c396e300
SHA14d593b6c131cb645c394a768d3fe0b62a2ef1afd
SHA256622cc4b329fe07dad3903c828534a2b7508c0ffe2817d808d2d8576f13a41fbe
SHA512b5ed14ef7d51b0dbfc0d3a2ceb199b0df78acf3d0a3cc494f32a4bd56b32c4486ca62578f60b6927ddb46cef19cf5eb92504a2b287aa2d8729b1893204b6071e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd