Analysis
-
max time kernel
39s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2023 06:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gclnk.com/MrBjn00xpN
Resource
win10v2004-20231020-en
General
-
Target
https://gclnk.com/MrBjn00xpN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133449366771520790" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2476 chrome.exe 2476 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2476 wrote to memory of 1232 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1232 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 5048 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 2856 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 2856 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe PID 2476 wrote to memory of 1984 2476 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gclnk.com/MrBjn00xpN1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9a489758,0x7ffa9a489768,0x7ffa9a4897782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1880,i,15184605109328619547,3576028553469169313,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1880,i,15184605109328619547,3576028553469169313,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1880,i,15184605109328619547,3576028553469169313,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1880,i,15184605109328619547,3576028553469169313,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1880,i,15184605109328619547,3576028553469169313,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4028 --field-trial-handle=1880,i,15184605109328619547,3576028553469169313,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1880,i,15184605109328619547,3576028553469169313,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1880,i,15184605109328619547,3576028553469169313,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD5394d309342b7d7ec46e84c667555efbc
SHA178c1b95009423fbef5f8b8f85ce5af4a998d8676
SHA2568551b2678389125a762f397fb3c2813b039ca7ac930e49b547b73f30abb9a6c2
SHA512c56183276d7c6d0a666a4685b644f21a2b04dc6ab0501f4c5bb724c9e26bf343e0ce2000f378902da666b9efbefe77d42df2cfc7a5f59abd1e9d6b4f594ca8ca
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD51393b3b9d7616c27cf17ce7cb0579f75
SHA1c1d8c973d5f159c20895eb08b3d8d28afb38a614
SHA25612669c4a7a1cf613d64c2cf3a7b8960c60f6a3111a40eef4ffa19534641eee74
SHA5124321057032e02cb30232643cf6420825f209a079090698285a9904ffdfb6f0c0c5011c643351cbb9c78e13ec2765c312172a97ea41cd2be37b802ce0ee2bf20f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5b55df614151f084ea567ad857d6e4a6e
SHA13c81d9d9e5616417cff2a612697850a0660c6cf0
SHA256cd1706917cb9b5f5740ae66637cc1153f1818e589f99d9ad0c4f7b9b4b4dd62f
SHA51266aaf30d209e98b92ec6598cf90978691478af586dce940d2b1f694af036ee9a0c02cd2aa4422c605cad7291e54cf42cdf96747c0b86a7d71b8908f5645c2d31
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
109KB
MD5f856eec5b1f48611fd1a9dc3a05cc846
SHA1836d99d4c08aef6073aa2a4547480d09b0179e33
SHA2569805209376f4a31e95e160fd0928cfcacf839543551dd1ea997d8f2b03609e01
SHA5129876f78b2e9c2a98906fa0906f723cf22b80e24761e1fc0a4d5a6d4aefb28403100f97f2ba9707c13ecaedddd91000fedb90a8e89bc4627c0dd6a10b1f8a4356
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_2476_TKUVUFKWCKGGUIURMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e