Analysis
- max time kernel
70s - max time network
72s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system - submitted
22/11/2023, 23:04
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.baidu.com/link?url=N9penFnsuN_GmD7rwRrovGhhR8tExTCVMMzqN2-F57cQlyMk0JE6b2GBexsdvC5Bb35il6XXcdZWLFotJGxDjf2Pw9XlV8Q2On7fPlshRJK#c3RldmVuX2NhbGxhaGFuQGpoYW5jb2NrLmNvbQ==
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target https://www.baidu.com/link?url=N9penFnsuN_GmD7rwRrovGhhR8tExTCVMMzqN2-F57cQlyMk0JE6b2GBexsdvC5Bb35il6XXcdZWLFotJGxDjf2Pw9XlV8Q2On7fPlshRJK#c3RldmVuX2NhbGxhaGFuQGpoYW5jb2NrLmNvbQ==
- Sample231122-22hjhsfa79
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133451678921274257" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1548 chrome.exe 1548 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe Token: SeShutdownPrivilege 1548 chrome.exe Token: SeCreatePagefilePrivilege 1548 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe 1548 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 2428 1548 chrome.exe 47 PID 1548 wrote to memory of 2428 1548 chrome.exe 47 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4160 1548 chrome.exe 86 PID 1548 wrote to memory of 4852 1548 chrome.exe 87 PID 1548 wrote to memory of 4852 1548 chrome.exe 87 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88 PID 1548 wrote to memory of 3084 1548 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.baidu.com/link?url=N9penFnsuN_GmD7rwRrovGhhR8tExTCVMMzqN2-F57cQlyMk0JE6b2GBexsdvC5Bb35il6XXcdZWLFotJGxDjf2Pw9XlV8Q2On7fPlshRJK#c3RldmVuX2NhbGxhaGFuQGpoYW5jb2NrLmNvbQ==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd77539758,0x7ffd77539768,0x7ffd775397782⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1868,i,17305427755341757959,2139606949589197960,131072 /prefetch:22⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1868,i,17305427755341757959,2139606949589197960,131072 /prefetch:82⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1868,i,17305427755341757959,2139606949589197960,131072 /prefetch:82⤵PID:3084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1868,i,17305427755341757959,2139606949589197960,131072 /prefetch:12⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1868,i,17305427755341757959,2139606949589197960,131072 /prefetch:12⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4532 --field-trial-handle=1868,i,17305427755341757959,2139606949589197960,131072 /prefetch:12⤵PID:920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1868,i,17305427755341757959,2139606949589197960,131072 /prefetch:82⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4908 --field-trial-handle=1868,i,17305427755341757959,2139606949589197960,131072 /prefetch:12⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1868,i,17305427755341757959,2139606949589197960,131072 /prefetch:82⤵PID:812
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 408B
- SHA256 3305861db401f9c853a4ffc1a2512db00d77077a07d174c2b84d15bdbb5a6043
- MD5 c2d3d6de44c1820ca9858063cd2052d2
- SHA1 937fbbfcfa2cea5cf0ec905955f6dbf90f413cd8
- SHA512 cce1b6b3cb385966078c853e8580c6f89900a32c56611aae010872d821032993fffc64a7d7c1ae7699562d93c98c2a6b01dfd770023b606e02b4128588e0870e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 869B
- SHA256 02cd1550d7fa1beabc850eb31d77ab14d16f59feda32e74e9a736c63369ed4cd
- MD5 71d7a23817e12f958baecda853bb900f
- SHA1 67384e9ca1b47c33c6d206f6aec3595a78c00e99
- SHA512 571b12a2984ea5fa5d31944464aefe524b706834d90642c1bd4bffd07a69cc73250cc169bd85adca80e586b0bcf82d0c2403be1cd114b77f1f3ca5e4860ed7e0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 191bd08cea87d9a5e83a398235c6baf6a75705d699ade5e61e9560339fbf732b
- MD5 486bd6cbb37572289899f1f03a5edfcd
- SHA1 8eb0b678cf62f635117b84aafad9eb1ad426824b
- SHA512 ccb0fa2afb0475c50188dd1de4e0e3ed1767eba22981ea00947a711418108c2c9bfa8f0a8e6bbf05ab7a4b3d853571b7422030e45d3a70b704cfd3b114f0a182
- SSDEEP 192:arIUW8syy+FIb+WNkkgkaoEEnotjEsXtScPS:arIRyxa2kaoEEotIsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 fd53474bc8f87c85e3cc735a64940c7fae55aa4d4f0074473f97afdfd92d34e2
- MD5 6089162b8c4f986e8903bd9a9981c2d9
- SHA1 a54c95f9583e6a6a1c1171e81cf075b07d90a513
- SHA512 e095dbe5f3f1a97833f694d04f7aaaa6f9b692e46289f1cf35d34bf8605f4d0cbecab95bd4f0ade14af27c9129288076256acf1ed9f549b151a91a2aa82a4a25
- SSDEEP 192:arIUW8syy+FIb+WNkkgka+EEnotjEsXtScPS:arIRyxa2ka+EEotIsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 109KB
- SHA256 b4f1761e1393d2faeb6a9b1f5ae42f392bbc2f3682d4655ade2bafae9a1dad92
- MD5 c686e4baf61d18a837add5d38b40e28c
- SHA1 c50169a019077db3b8e169665e51fd4987e3f165
- SHA512 3b1c49ace8a88dbc1f35bfd932036ceb8e6624abe083060658ae0bb6d08591d27880b9f795e94feb20017e18f101f70255a9ed73759433d34830327ca096ed00
- SSDEEP 3072:S3w6D5yAQyCBhWg9KJABBVjbmYp8FeqV4Op:56UAQTB8gpHVvp+uW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512