Analysis
- max time kernel
112s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system - submitted
18/11/2023, 07:22
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://secure.adnxs.com/clktrb?id=704169&redir=//cmdpgcollege.in/Europecontract23ss/approval2023/Ril-eiuehrgy534gh4g7834y5hh8g4gh345g72773/[email protected]
Resource
win10v2004-20231020-en
windows10-2004-x64
8 signatures
1800 seconds
General
- Target https://secure.adnxs.com/clktrb?id=704169&redir=//cmdpgcollege.in/Europecontract23ss/approval2023/Ril-eiuehrgy534gh4g7834y5hh8g4gh345g72773/[email protected]
- Sample231118-h7pegaea3x
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133447658027326975" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3196 wrote to memory of 2308 3196 chrome.exe 47 PID 3196 wrote to memory of 2308 3196 chrome.exe 47 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 1836 3196 chrome.exe 89 PID 3196 wrote to memory of 3164 3196 chrome.exe 90 PID 3196 wrote to memory of 3164 3196 chrome.exe 90 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91 PID 3196 wrote to memory of 3364 3196 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://secure.adnxs.com/clktrb?id=704169&redir=//cmdpgcollege.in/Europecontract23ss/approval2023/Ril-eiuehrgy534gh4g7834y5hh8g4gh345g72773/[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd60059758,0x7ffd60059768,0x7ffd600597782⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1196 --field-trial-handle=1892,i,12876529494731586647,4048777088259649,131072 /prefetch:22⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1892,i,12876529494731586647,4048777088259649,131072 /prefetch:82⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1892,i,12876529494731586647,4048777088259649,131072 /prefetch:82⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1892,i,12876529494731586647,4048777088259649,131072 /prefetch:12⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1892,i,12876529494731586647,4048777088259649,131072 /prefetch:12⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4616 --field-trial-handle=1892,i,12876529494731586647,4048777088259649,131072 /prefetch:12⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5036 --field-trial-handle=1892,i,12876529494731586647,4048777088259649,131072 /prefetch:12⤵PID:4496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1892,i,12876529494731586647,4048777088259649,131072 /prefetch:82⤵PID:4412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1892,i,12876529494731586647,4048777088259649,131072 /prefetch:82⤵PID:4356
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 37938c3eda055fe1d74989ba892b42df3ae85dbfcbdbcd6b1b97c4ccf7f2fae8
- MD5 3045dd45dce8227b9d5e362b1d7b890b
- SHA1 23df310452bede3e55a4f84238ee9288ac5a2c8d
- SHA512 2830488b2fb09675142159c2a6fc6234f778e8ea71bc5417186c0a17d3af1b37af2b857b6c8280a89ecb54cededbb309c2555e57154f9a13948206c0f9dcfc04
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 9c4009f7c28efe63e3998b03bf1995f167562ab0d46fae07f0b008f5a9da8dd4
- MD5 5bae4865572b9096f697925718f8c2b1
- SHA1 f743e27bd9ee250641845b9bceaf27859b0792e5
- SHA512 5fa5818b54d8e8628fcf98674df5339a862ccc7373b2007996a6328594b9b4e93bd5fab21b8a75475118a27377838e28e54317acc52f01aa4e04e41252ef6cb6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 537B
- SHA256 a9558458974b01c3458169e79495dce20b32e88e91a56d095004757a2f4c7b98
- MD5 d47207e45ff8b8df5f6e7af7916bc3e9
- SHA1 6e1507a04558be8e635890f5241a85f1a0d94e4a
- SHA512 d20715a419d716885b609907514089d65db7049e260aec6c2830f8140098af00f7422ed0b6b225c42d6119b1843041538ffa8e4746c8b8727b89cb20adb38a40
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 a313c264f2a7be69885e682cca0082cc90a901240c98ec1a4dd2e57358670cac
- MD5 85ccb3181763a2929567b5b1162c9b63
- SHA1 fe4e5f0b2eac605a471393f9e70500f04e67e896
- SHA512 57c3af05b9d04cf3905f5974e4f36caba64473a77b9ae0127be0605524bbd1c21bda1d38d34d095eeb39f1fc2439c6563260d3d32a0efc53fbe494a732f3a416
- SSDEEP 96:kQNgjTXT9v3g2HGJTKICTMzA8iZu/6sy7Di+6M5RgmdeUko1DOqE8AjVhYtjEsXQ:kTTy1JTs8qsyy+F5zkoMotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 109KB
- SHA256 a5f48fe03835e1b66d6aa9fcc6c599c43baf3bf645c9ab9a9c2bf80bc7026491
- MD5 abc4ee5804fda26cf2318e63bab162e0
- SHA1 787b977b0c2018e695e4cd8374771b84ac8e8fbc
- SHA512 bfe1ed15da88f7eeaa4b340ddda402ffb356066b32102c14b9bdeef7c6749349daefac5c9a5df94bdcfa0dac7edd2b3d5dc5c771c1d491884666af8e7087b0a4
- SSDEEP 3072:Pv+x+aZbVQsBd1VQOBXu0QdoaxxXWaEoE+Mq+Iruj/oH4+6+:PvwJZbVQsBpXTQT3Wa43O3H4J+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512