Analysis
-
max time kernel
600s -
max time network
592s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
14/11/2023, 03:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://onlinetaxation.pro/au/MyGov/
Resource
win10v2004-20231023-en
General
-
Target
https://onlinetaxation.pro/au/MyGov/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133444054134843427" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe 4552 chrome.exe 4552 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1920 wrote to memory of 4876 1920 chrome.exe 86 PID 1920 wrote to memory of 4876 1920 chrome.exe 86 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4404 1920 chrome.exe 88 PID 1920 wrote to memory of 4492 1920 chrome.exe 89 PID 1920 wrote to memory of 4492 1920 chrome.exe 89 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90 PID 1920 wrote to memory of 1124 1920 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://onlinetaxation.pro/au/MyGov/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6b899758,0x7ffc6b899768,0x7ffc6b8997782⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:22⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:82⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:82⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:12⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:12⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4484 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:12⤵PID:3480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5072 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:12⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5136 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:12⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:82⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:82⤵PID:4040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5112 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:12⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:8
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD51654abeda5d8daaab1daf9ae2547042c
SHA153279881e9c27de08f8c6819bf4d4b7bb3ed7103
SHA256d36da380cec6f63fdb13b0fd1c2acb32a6e53c3f9a8ba7418e78164d020ec667
SHA512fb6b6ee60698dea0f7ad9ed963696456597c37c483047642eab085dc8229b12092da9f3eea684533ad68f071859908802b5c905c7d663f18c5363f4c88752ac4
-
Filesize
2KB
MD53faa3e0c8b4d9fa45685bc838cb53144
SHA1bb5427a7e8e5c864f358f14d95841b540fed74ea
SHA2564843dabce7236dab03049cb140bba8f08a9c8ba1e450dea221c329b91095ef2b
SHA51270bd109ac3e3426edc2cec89cda073af239fede132c17154535c25c88c68e2b7dc0eb5d01771853a0f6fd6015ce581cf2368248a2da3dceba2cdc72397ae687c
-
Filesize
2KB
MD589a70d0e88719801e64e2911c3a4d0ab
SHA19ab904b55faedbe3893bdb15fbfc22b6e43a6bf3
SHA25680b1e138da5cf34c4b3e9e986ef6893ab1c427dd8de6262ea132dc113e098c7d
SHA512ad982f0d02b072b17aad595131da5cbf259ebb3aa11410ac6b1eafbaab7cf3c870eddd1eb4e32b2ca6f7c01f14f004b067bbec586882dbcdef587de9ef41e6f0
-
Filesize
539B
MD54e01cce7ff2cac0c61fb5622055d5f6a
SHA162a904ffc3b3b69e99ff00bc0505a95167ea6cde
SHA2562a77b16812c0fb58aa11ead16860f38135d0f3b0e278f5b074a329165360f969
SHA512ea9f3429a70567e055de40e2883d37c4043cb96fafc595e7f7e6e6b2bbff3d10e49f5de49179fc8a29bad364001d4a11f2bd6e9b02a7ad85e29df4a717e49ddd
-
Filesize
6KB
MD571ce79c7c3254b22982928fa89b6694d
SHA1ee2f659d471bbd6877f9d897c9b03197f8bd8dad
SHA2563b5dc46d9f0ac8cc5685f2ff00ed18cebe6383e55273696de44bfd5044568608
SHA51244e661d67e2140d44ca9cf40938537673ed0d496362bda59e8315f06725bda05de0714da96308502bb9d5588e8bed237cbc07bd3354251c73cfc2209e5698d58
-
Filesize
6KB
MD52caa7fee881f5365aa3fd8a31de455a7
SHA151410efa77c9d296491dbc85f783977d96beb954
SHA25623f3a461d60c173c0295b56b4c24a332b8e855fcc01737f5b20f77423522cfc9
SHA5123c9bf3cf9a5f45c50dc25c984c2ad020f125eb82691cacf78a815f49c67f44df318e85a89d670965f7cbdf27e801c7586ce4c1a1e4b5036c3775f4dd1267a23f
-
Filesize
109KB
MD5863e10fdca09ca0e5fc6366832350f1e
SHA106ae940f4a07085ba7cfec453c952b01f594091f
SHA25611e5a0efd3a195a91b3bdf0441c7e2783e8062d163c3e67bf71cd95a5721a227
SHA512bb8a5e7c0b8fef7223f8a1bf42c489ac4942a716fa573f9296631a83c73c975578df5817cb8b027ad5ccd4aebe10fc3f88d58d74bdbc36da3a7351486d9f57c1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd