Analysis
-
max time kernel
137s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2023, 11:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://obfrsusydtyttdreyzz.blob.core.windows.net
Resource
win10v2004-20231127-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://obfrsusydtyttdreyzz.blob.core.windows.net
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133468539709692103" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4856 chrome.exe 4856 chrome.exe 2144 chrome.exe 2144 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4856 chrome.exe 4856 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 3028 4856 chrome.exe 86 PID 4856 wrote to memory of 3028 4856 chrome.exe 86 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2112 4856 chrome.exe 88 PID 4856 wrote to memory of 2740 4856 chrome.exe 89 PID 4856 wrote to memory of 2740 4856 chrome.exe 89 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90 PID 4856 wrote to memory of 1420 4856 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://obfrsusydtyttdreyzz.blob.core.windows.net1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa548d9758,0x7ffa548d9768,0x7ffa548d97782⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1892,i,12660918312846037349,2979200194814886597,131072 /prefetch:22⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1892,i,12660918312846037349,2979200194814886597,131072 /prefetch:82⤵PID:2740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1892,i,12660918312846037349,2979200194814886597,131072 /prefetch:82⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1892,i,12660918312846037349,2979200194814886597,131072 /prefetch:12⤵PID:3756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2920 --field-trial-handle=1892,i,12660918312846037349,2979200194814886597,131072 /prefetch:12⤵PID:2300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1892,i,12660918312846037349,2979200194814886597,131072 /prefetch:82⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1892,i,12660918312846037349,2979200194814886597,131072 /prefetch:82⤵PID:3104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2468 --field-trial-handle=1892,i,12660918312846037349,2979200194814886597,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2144
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50e19178efefe964e0e3b4cba5e00b935
SHA1c748d3bdcf983ff3707889ed3f7a8c9c0f7bfc98
SHA25621985d5be164e0a24c2900f352382002f8bdf1cbce2adee9289bf5215254bea2
SHA5123ef0de8d4497dc46ceb5c4a4a07f3b883f10d34766ab1adfabc65437e2c6c6bc0c473841d3250f51ddde21e390214f34e7cac386d3acf664ae9d841566696947
-
Filesize
6KB
MD5495678b8018b8f409b28a7c51b9ad829
SHA119bd30e45cb7f3d467657ac0d7a142609937b782
SHA2568df31717cb52ea12bf68a17ae3b106ee5113cf74d200f1cc8383235a22832e40
SHA512a5f177599df78a561ea6634048aececf6182c30777510ae3367f905ce77a49fc5c0ab86bb935141897b04631050456cfe46af4bec89581ca88e8920ca76af5c4
-
Filesize
115KB
MD5abd7228fec6682b60b2958d777af7ae3
SHA19d4fadbedc564c979ef5271b3afef98555e168cf
SHA25600be10d60b4cd9e916776e663c03fb841e457c1e2ee454d9e23bc4c9ee81542d
SHA512ae7972b687e40081723657a1c23878fe8f818c91f1b547bfcf5bcbb5d81b46e5a2c5313767239469f934e19420835e35199fe34bfe9c52fa8aec90f3e6e56a5c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd