Analysis
-
max time kernel
1199s -
max time network
1166s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2023 13:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://aka.ms/learnaboutsenderidentification
Resource
win10v2004-20231023-en
General
-
Target
http://aka.ms/learnaboutsenderidentification
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133453055111194603" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1876 chrome.exe 1876 chrome.exe 1828 chrome.exe 1828 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 4152 1876 chrome.exe 83 PID 1876 wrote to memory of 4152 1876 chrome.exe 83 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 3188 1876 chrome.exe 85 PID 1876 wrote to memory of 1572 1876 chrome.exe 89 PID 1876 wrote to memory of 1572 1876 chrome.exe 89 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86 PID 1876 wrote to memory of 4460 1876 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://aka.ms/learnaboutsenderidentification1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd14029758,0x7ffd14029768,0x7ffd140297782⤵PID:4152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:22⤵PID:3188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:82⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:12⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:12⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:82⤵PID:1572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4640 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:12⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3508 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:12⤵PID:2392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4972 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:12⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4984 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:12⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:82⤵PID:2280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:82⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3508 --field-trial-handle=1860,i,12597083118873732329,9714214279949094093,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1828
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
696B
MD597c2c4529b701353459fc75bd497dece
SHA1a2c9620bf8f7cff87b2ef8a91f71e1085216e6bc
SHA25601752dcab39f60920d46a3bcb04aefe5641486f673d6017ee7c050f35a3098bf
SHA5124dd0e080500bd9fc693b2bd44f8b225907f396ca5f6058d0a55b66a657c6da8f2c105d802851046b9ab9352a0cb18cc3969ef8cd74526a3d12e3dd8cadede8d5
-
Filesize
1KB
MD5bd877c44a1b685455f46d786cb063551
SHA134aac01399dd83bc33bb434c82ae3bcb217cf315
SHA256504368bccbf71c17540258067b6154a640238da3993322fa776c160048906670
SHA512c94258e2da9917e4a962aaae1f7dc0bc31b6b338cb10bcbf03a6585114029e1a88954170b623bf6ea2c003fe186eac9bcca7e23ec83878ebb7571766f7f28e92
-
Filesize
1KB
MD5aa047019fb43599a429a3d67a6c73ea6
SHA1d44604069b3e231f096165be80ab1e78f6ae2f45
SHA2568acb707ede47425b2cbfeee2a384a58f728c23da5d843890b6caf698b4bf161e
SHA51219aeca65aa92d56437e459039f4e39371a62d302bf9d5c86f9dee215702789375c9f6998f3491123f1af6d477108ba78fd7d33d9aa8d820504a29b583e15fad6
-
Filesize
1KB
MD582c9ced6bdc7ef386cfa0a7e7c7990e7
SHA1d30be2b50e419f885f1f507eac2537ddf9734c78
SHA256d9ead47da5f4035ddf11a20b672885bc25a901764816c0f2d3050641a6317764
SHA5124eb5842bdbb3632348fe628105f1ab153a0ca364f6efd19d761f25f4ddee65d81dc7589d29a3658d06b49d9debb06ad6a0c3711bbba59ee39a36739de3d6b866
-
Filesize
6KB
MD5d82065a13040bb980b4046e0a3ec38fe
SHA108b7794ffa11a5e00a2aeba27723e5b9416f43c9
SHA25625a62283221fb1b223f7c8177207975191d601c086d95f613cb182614fe6fe87
SHA5127012d6c55714aa6d47751265203d1b49534781c5d8be770fb64ee5bf74388e77e6dadec0ad06c80575a8a15e14c147914ceeacc8e21fd641cc139470adbd9dd0
-
Filesize
6KB
MD5c79e57fb3e821dddb96957c0a532f6c5
SHA1fc397eed32007d8d990bb0931817332dccfae8e5
SHA2564145cd9f7334bf4f88d18e17b68f45ae4cad74b1e002a936a0bfcd79cf78b355
SHA512103562e1afc88c6fc7d18fe8396208cbf3e4fa19a0e4d516c6c95cbd9c2742b761e9e060308c378e4f04408bee2a3f2403b9bc4c8970d325826ed669d86b4db0
-
Filesize
109KB
MD5ad48ac43ebb2c94334df681d408a9f97
SHA17afbf6c735a10ec817aff04dbdb889fefd88c587
SHA2566eaa1f9d792cd46b8dab9ca58f733cd7b35fcae57f960405b900f34ea82e31d7
SHA51214c5e6b8908388c91a2cb6ce2672920d4a9bad5ca48b2605e54f586e8e15ee6d862f3de16b690e6bb29538f83cb238251d59f771c4bef57eee00533d37fd9ccf
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd