Analysis
-
max time kernel
98s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2023 17:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ci.criticalimpact.com/unsubscribe1.cfm?eid=160324309631ab12041ad8cde91a9694&c=42143&jid=e445faf1030ac3d83947229f28c3afba
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://ci.criticalimpact.com/unsubscribe1.cfm?eid=160324309631ab12041ad8cde91a9694&c=42143&jid=e445faf1030ac3d83947229f28c3afba
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133450601124572243" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3272 chrome.exe 3272 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3272 chrome.exe 3272 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe Token: SeShutdownPrivilege 3272 chrome.exe Token: SeCreatePagefilePrivilege 3272 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe 3272 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3272 wrote to memory of 1752 3272 chrome.exe 67 PID 3272 wrote to memory of 1752 3272 chrome.exe 67 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4708 3272 chrome.exe 93 PID 3272 wrote to memory of 4172 3272 chrome.exe 94 PID 3272 wrote to memory of 4172 3272 chrome.exe 94 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97 PID 3272 wrote to memory of 2196 3272 chrome.exe 97
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ci.criticalimpact.com/unsubscribe1.cfm?eid=160324309631ab12041ad8cde91a9694&c=42143&jid=e445faf1030ac3d83947229f28c3afba1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb57759758,0x7ffb57759768,0x7ffb577597782⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1856,i,16410902138307031683,6020617149829988431,131072 /prefetch:22⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1856,i,16410902138307031683,6020617149829988431,131072 /prefetch:82⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2792 --field-trial-handle=1856,i,16410902138307031683,6020617149829988431,131072 /prefetch:12⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2784 --field-trial-handle=1856,i,16410902138307031683,6020617149829988431,131072 /prefetch:12⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 --field-trial-handle=1856,i,16410902138307031683,6020617149829988431,131072 /prefetch:82⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1856,i,16410902138307031683,6020617149829988431,131072 /prefetch:82⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1856,i,16410902138307031683,6020617149829988431,131072 /prefetch:82⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5437fcb9d644ffad8d44028fa6b5afefb
SHA1654e8966123a6b48609e7258649eeed8056d6ece
SHA256b2fa01e16be73f95998f04307e93ad7ed9f8fcd93f2fcecf433195e716f3fc1a
SHA5128c275ece393a1a2af9198cb686e746631db3452bf9d3f71194f3e6e39f6a9244f86ae26f150357e87f09c1d95be44fa02a59a114772a115ffd1237fe91d07ca1
-
Filesize
6KB
MD5ad35857a5ec391a013d1c102c1a59985
SHA1f94809bd8d03d58e7d1d0f75a1b2df0f5de6febd
SHA256aa8d5c47fcc0e2983db252878663dafc1c7bdf24f311d795533cc9785bbd5f27
SHA512ebaae77adb645dc4cc606e79904c8d4d834abcb7884262077810f561da1d62926fa51d6ef5c7f2273463d7a2987836d00ad0c5533bdc8eb28af8f8764042caa1
-
Filesize
6KB
MD5a971731b8e88c1a5786e0ca2c72e0b85
SHA1b6d1b70ad5293350f624c9e983e74a1ececdff4a
SHA25680b046187f146b0f76f016a074de0018b208729fc58e2bcfb0a28d0e6ab66bde
SHA5127ffb9b1e21a08346e701f09245e428673664a88dce5d02e4d86102d2d306aa6037139d1834cc96660bf56ed96b7463ae6213e9493132496448ac312641e32593
-
Filesize
109KB
MD5b42130d92e6cbee7749a17b1fc46edeb
SHA128ef3078a5366a83ea05c2ff3573a21a732e4197
SHA25653f5c281ec55ab769aa273038edc54a0cbdda8c5282d37cf92e57e48e6ee206e
SHA5129f71bcbfcd75bfcffcc7da94cc8f4ef58ca50bdc7b2ac9ae16db1b8d04dc2c494d787d4b64a8bf1116dd3a47947745a2d0e2417b6c0d51f669a5c481cf02b37a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd