Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20231025-en -
resource tags
arch:x64arch:x86image:win10-20231025-enlocale:en-usos:windows10-1703-x64system -
submitted
19-11-2023 23:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.site-shot.com/
Resource
win10-20231025-en
General
-
Target
https://www.site-shot.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133449096538147082" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 312 chrome.exe 312 chrome.exe 4660 chrome.exe 4660 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe Token: SeShutdownPrivilege 312 chrome.exe Token: SeCreatePagefilePrivilege 312 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe 312 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 312 wrote to memory of 2920 312 chrome.exe 71 PID 312 wrote to memory of 2920 312 chrome.exe 71 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 3940 312 chrome.exe 74 PID 312 wrote to memory of 2760 312 chrome.exe 73 PID 312 wrote to memory of 2760 312 chrome.exe 73 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75 PID 312 wrote to memory of 1548 312 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.site-shot.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd13679758,0x7ffd13679768,0x7ffd136797782⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:82⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:22⤵PID:3940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:82⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2832 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:12⤵PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2824 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:12⤵PID:2852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4496 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:12⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4692 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:12⤵PID:656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4844 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:12⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:82⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:82⤵PID:928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186KB
MD59f61d7b1098e9a21920cf7abd68ca471
SHA1c2a75ba9d5e426f34290ebda3e7b3874a4c26a50
SHA2562c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71
SHA5123d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029
-
Filesize
336B
MD51a5ae16b46de3c5213977b067dbac8b2
SHA1372781572a532ff774e69ade3067c2e5ce6a86d0
SHA2561ba21035a3c0a9bd843a2733da4aca78ff9b2af880fb73de5e645e2375f761ab
SHA5125a664fdc7645f0240de95a610d108434649b684810038b85ec005f1afb082bde453f869e969ae40909eaa7322c75fd9d82cd092a5233bbec44860a6a5a59c6be
-
Filesize
3KB
MD5e03549c79e909974f90aec823eb782b6
SHA10025fc2fb13018c9d018ea77e38bd3084c713f44
SHA25689094d82e321858e1eadeaa0df77b7cc8820d18d9d5611cab399b58a29687563
SHA5128f53214144771ce7e87c0cee255bd5830247782ced84d88ec5582fa6e4b036a0780ad47e51a8a761c50ea3ebb2b5051bd4b708ae884056e7e0398cca565b3239
-
Filesize
1KB
MD5da21c0b8ffa59023051b4785021f6355
SHA146ca0609370a4c37f8f7df338864cb4cecf0d385
SHA2560b265bfb0e717d4f307cc827fa3d873cff17ace729edbe93a823fb47c5c3c1e2
SHA512009a32c6cd33b658a7adea2385f2ee34c4c0d00d3536881753daa6ce1b132a8b0ac7d6f3bb5157e34d817e7edd2aa58aaa051aa44b962720348a8f4ab24d7182
-
Filesize
1KB
MD5f91a4ded3b1a7d2089186eb51da1a77e
SHA1b361fbcd9f8f56682e91c53f8b0c76998d173083
SHA25678b6a820e16d0feef078579245732730f97f8e2156547d689accb9bab85a4320
SHA512899b69c72233f6d187b19aa8e369868140197629bbd7db5a2953f5eb6b9ef88c6d0a9def68bc282694242c91408c896d2a649f4dd8e9629a62b0315626edf92d
-
Filesize
5KB
MD5be8091c2f9084412dae8fddfa7de80ce
SHA1e10ff13bec51389af6e97f0f43e72847cc78ba1e
SHA2563912259bce6588a2199da351e6e8aa273cd65aa0eb0a9131af7551045aee2007
SHA512934e8bf25a1e4de934d9b3eab5c330c88bae6f2d123f026cba986f9e7e6272b5d3147c238ad915c6d2c5039d569fe40d881d00d3acad8dd947c0e2b103c540e0
-
Filesize
6KB
MD5f66736727ca30852ab6f0152494aede7
SHA12c2dfdce24dadb9458d37dcaf97894a1d38fe44c
SHA2564ea3bc7ec80a8eb75b61832ffeabe8a5c52b5beb5318c232fa8e52541993c0e4
SHA512f6c4113c54e8562ec583822ab26a6d61a04f691d8739cf356443fecf00943031f4dcb3d3d41952c2f685c8384672e1cf9c5fc7dc8baaf70f914abe0e104cae22
-
Filesize
5KB
MD54760962b3afd0225e7365261de6f1479
SHA1ffabafa87581cd8ffa0856997c9428d83c736645
SHA256fc1e01697273888d3542c1291481e4beed1ae703b723ed9b78c48b2e5c60d0bc
SHA512acc072242142d2e5cb957708553d047dd7cfdbb269216c3b6408bd2c1ac95506735a94aa7986cfbf49b1049a455980544bf6ba69e56bd01d79edf2614c740fd1
-
Filesize
109KB
MD5a5fb993c0f74df80fc8720ad65773e34
SHA156b99e61749da8ee7583526480833f72d76890ec
SHA256ee707ee1f61f594bf3f1730ac5ddad8f20b789a072f615ba4187d1ad1c57687e
SHA512b02a37c3a3edc69b5668d28490994dbeb982cd43b83008675aef635d1ca1a3d043c9f8cf3ce8fc273d1e2febd2b9d91e79f340f77593ebf438beb0e67f32436b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd