Analysis
-
max time kernel
178s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2023 23:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ChCsl.com.ng
Resource
win10v2004-20231023-en
General
-
Target
http://ChCsl.com.ng
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133449102576357835" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2224 chrome.exe 2224 chrome.exe 3556 chrome.exe 3556 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe Token: SeShutdownPrivilege 2224 chrome.exe Token: SeCreatePagefilePrivilege 2224 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe 2224 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 1832 2224 chrome.exe 86 PID 2224 wrote to memory of 1832 2224 chrome.exe 86 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 1372 2224 chrome.exe 88 PID 2224 wrote to memory of 2784 2224 chrome.exe 92 PID 2224 wrote to memory of 2784 2224 chrome.exe 92 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89 PID 2224 wrote to memory of 3324 2224 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ChCsl.com.ng1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef3409758,0x7ffef3409768,0x7ffef34097782⤵PID:1832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:22⤵PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:82⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:12⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:12⤵PID:3412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:82⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:82⤵PID:956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4688 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:12⤵PID:1932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:82⤵PID:676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3556
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
528B
MD54a3297fdd1650a409f9cf0c37ad8da5e
SHA187636a97c97cdbe04a9dd9a5274d4cfa5025903f
SHA256e00b5ef1084b751a290ddd9f7ed385d76d3113cc94e8d50863c24b1333f05561
SHA5126cd6ccabb3410848b1261c25d93cbf297f482dfbcef006d27b758662ccc58e387cf732c2268ae76415b555ba589dc931aa8534bad2e4f939529d0c39d6daab64
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\486b306c-bb79-4b59-8f41-ddfcc21f92a9.tmp
Filesize2KB
MD5bcc39c156f815f75b39cacf3bf0230fa
SHA1ffe9a5feee57b6c0a1f379c73575231d61e5bb0d
SHA25697fef9446383bbd32c167adef72138e4139c8197f03ad25730011513770aa1a5
SHA5122ecc299b5d839e39048acb1e6a1875cb90d9729800e45e16038d1148419a09cbd6a4f9e59f3d0deb848309e9d2a7e95f628cc7d1d45f4b7bbf35391be18f0e7a
-
Filesize
1KB
MD5997eed2caca35cd1c60214f9c99db361
SHA170a58d2a3837bcf2774d667212fd46074ce92b03
SHA2567d029807476b27033bd429437b2514810c878e0d9472052f22c5bd3ed3f914da
SHA5122f515d1cc63551b9a87b00f5ea0bbe632dcb05567bd94bfd4c9eb3e3ac61b6236c1247737410cae2be38b26a613407e71bd7e114ffefe82891648b6d8ea819b8
-
Filesize
1KB
MD57e145924bed43ef0c87c706e91dd835e
SHA1950651ca75217107b370697965ce8995338ecf8f
SHA256bd559ef00d12890e0fa81569b2cbd42027809b6a25e11534125ad098106f2b1d
SHA512e2d48a62cfd115bc2317b5c169b29839d74508fc5f2a519e353b0ac529ad3a0c860743dfcf3d2eec67e1b3afb2d3a51c98e1855565db3991aaea4af585585d35
-
Filesize
2KB
MD5c30bffcc26c5ef5d3ebfcf77aa69e703
SHA147cd646de0387fcc1dff8ccaa2013d382b9ad987
SHA256ba133aad8909c955db5595a3ad19c7eae5279e941d9ef0bebccd107836f47df4
SHA512352b60aec0558eab3e7dbe7b585cfdd9ef20c946a21a5903b4d044ba6a547919c6e0b6bad54ffa6fd1599d9d041313bf509aeabcf05c79f7f3e4b79b779a72e1
-
Filesize
539B
MD5a08d42c37688efb65fcd84e456b67c27
SHA180ba661d7710da4a91247e4ffec6ccea4ad02aa1
SHA25644189e524f001f5b2b64ab5970b2d807e692248cd8c30b4e984bb7f046207714
SHA512526656cf7b8c47996f07350b237fb0e4dee4eaa68aaddb5e88803d513463585fb8f2ae6670d3f66a30a82ebdf313c10a7ce0d25ae63568d8a207c78cd9b2ada8
-
Filesize
6KB
MD57673d27772321c9fd9c5f3d6d157fbab
SHA10e3919941f2ea965a33caadab3165f8f72eb958f
SHA256017dec12a8f644a36a0a58e06773b40e6d779f4c71cbc42c396f70b1449c4c02
SHA512a17fd2b93d4bcd101f16802a5f0877a42c8a28b4ad5fac5b1e0f432e17aeebf69d316d80b35b243710ccc7e99776779481da4921fb830b2a0124d82f625032e2
-
Filesize
6KB
MD5c7d8c450e895a476af672a07b847796a
SHA181d1aef4c323f2abbd11a2f7413ce5a1a62aaeae
SHA256255fbe70d241c7bd803bad4e77625ea849974feed22994c7af6b88dcc9f8ba92
SHA51259514f80af5cef3df022bf5f91790aeede97fd3503b3c6b45659210ce17ab499ef08693e663aa6df93d1e1a10022976a06c314234482c62fd62cfd7f66fc973d
-
Filesize
214KB
MD5210327dd9af8787bdb08392cdb0cc651
SHA17334182b8d1798a99cdaea73918a42ec6ed4da38
SHA2566eae68ca5b387b5778c4648068ccc34db06cf8c9ae1ca3c96e65d77d9cc2851b
SHA512fd6413b121d40d9a5c29b7f1fb136caf2c900279f6c802d002caf3e8097b59117053588f48f81b81e7d41810240fe5150c9dbac551f2e6d96aeed05fbdc49832
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd