Analysis
-
max time kernel
40s -
max time network
23s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
28-11-2023 03:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://script.google.com/a/clickclickmedia.com.au/macros/s/AKfycbwgm0HkqeR8gbUmFKpmWEsPa4F6-A7U76V2L3QK/exec
Resource
win10-20231020-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://script.google.com/a/clickclickmedia.com.au/macros/s/AKfycbwgm0HkqeR8gbUmFKpmWEsPa4F6-A7U76V2L3QK/exec
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133456166804299957" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 724 chrome.exe 724 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 724 chrome.exe 724 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe Token: SeShutdownPrivilege 724 chrome.exe Token: SeCreatePagefilePrivilege 724 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe 724 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 724 wrote to memory of 4476 724 chrome.exe 68 PID 724 wrote to memory of 4476 724 chrome.exe 68 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 1112 724 chrome.exe 73 PID 724 wrote to memory of 4296 724 chrome.exe 72 PID 724 wrote to memory of 4296 724 chrome.exe 72 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74 PID 724 wrote to memory of 3184 724 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://script.google.com/a/clickclickmedia.com.au/macros/s/AKfycbwgm0HkqeR8gbUmFKpmWEsPa4F6-A7U76V2L3QK/exec1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9c6979758,0x7ff9c6979768,0x7ff9c69797782⤵PID:4476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1916,i,139427871977219630,6063584582061969004,131072 /prefetch:82⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1916,i,139427871977219630,6063584582061969004,131072 /prefetch:22⤵PID:1112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1916,i,139427871977219630,6063584582061969004,131072 /prefetch:82⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1916,i,139427871977219630,6063584582061969004,131072 /prefetch:12⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2804 --field-trial-handle=1916,i,139427871977219630,6063584582061969004,131072 /prefetch:12⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1916,i,139427871977219630,6063584582061969004,131072 /prefetch:82⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=1916,i,139427871977219630,6063584582061969004,131072 /prefetch:82⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539B
MD55c9eabf5636e4578857f13457a1570ef
SHA186fcc22ab30de46e10189630a1f59a883e1d5cd6
SHA2568d945c2fc8e2a4196c958b902025e6ba511ab6b78fd72ca04618ce1c1073731a
SHA51203d1de81518e1772a5a1845eaa6d001aa75c18427887614082ea500e89c7162598711f2f5337ffa6dc15d648f7cbcbf4884074d3a705569371105da4b816d902
-
Filesize
6KB
MD5abb4c42a60b6a792ac9ac9f345c59c78
SHA172e22807e70401cb02f7d14a4f0ffb76767eaa2e
SHA25690240d1e5419b4ca327b41a9b589c7e9066bcadddbbde54dc23e9ee67a73d501
SHA5124ec3c892eca456647fcb5434fa16a64e13dd5a9e96e07b9e86b2c15b05a76d0aa0924e0aa19b6de91fa994a9fcf363c5ad15c60e3de0045c1811c573275f17f9
-
Filesize
106KB
MD54f6aacf815af5255b9312996bb40b509
SHA1cca166110a8ebfeaf1088525b51b0d51c71813c7
SHA256bb0c7f073fdfab57f970826025d13797d1eaab7a23177224f888661b072d6b16
SHA512a8b52c7a04a2ce7a562b26691843f77ffc0688a078c3ed28f35ca5d40bd93428fa3a5e7c7c99b1ac096c08cb2a9644e7ac28b2dfeb46b42bef55ceb09d1f42d4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd