Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2023 02:24
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cozpig5nezho-1323053341.cos.sa-saopaulo.myqcloud.com/cozpig5nezho.html?e=john.cena@hobbit.com
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
https://cozpig5nezho-1323053341.cos.sa-saopaulo.myqcloud.com/cozpig5nezho.html?e=john.cena@hobbit.com
Resource
win10v2004-20231215-en
General
-
Target
https://cozpig5nezho-1323053341.cos.sa-saopaulo.myqcloud.com/cozpig5nezho.html?e=john.cena@hobbit.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133473398817275656" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3476 chrome.exe 3476 chrome.exe 808 chrome.exe 808 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 3476 chrome.exe 3476 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe Token: SeShutdownPrivilege 3476 chrome.exe Token: SeCreatePagefilePrivilege 3476 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe 3476 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3476 wrote to memory of 1620 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 1620 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4928 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4232 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4232 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe PID 3476 wrote to memory of 4924 3476 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cozpig5nezho-1323053341.cos.sa-saopaulo.myqcloud.com/cozpig5nezho.html?e=john.cena@hobbit.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d2379758,0x7ff8d2379768,0x7ff8d23797782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1844,i,7399763689736776760,18128989667834569655,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1844,i,7399763689736776760,18128989667834569655,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1844,i,7399763689736776760,18128989667834569655,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1844,i,7399763689736776760,18128989667834569655,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1844,i,7399763689736776760,18128989667834569655,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1844,i,7399763689736776760,18128989667834569655,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1844,i,7399763689736776760,18128989667834569655,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2468 --field-trial-handle=1844,i,7399763689736776760,18128989667834569655,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
240B
MD5c173cd7dd6ff3c97197f31559b795395
SHA1c09837284de04ab49c37ad28f6246edce42b0405
SHA25617e781348ba8e8b34b5e4d3f4200dee85fb23acd826a6dacd8d8f2f6d8fb6d1a
SHA51285f5d18ebb260b2bdc2791c2bd7e756db58f9c9522b8a21e4292d4533c68a7d9668002dd5dfc5586b5fa7305a63eb4dcbd57309b4985b424f1fa0c95be43b10d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD56c9dec2205b977dbe420ef89095673ce
SHA118f8c8c529968357d5b20c98ba39db43550ee93d
SHA256d8058f2b1757831194b82d667b10de7f61ef2621d0b59151f386fdb795c963cc
SHA5123874586ab1bcdf8c81093e34a604419de069d1b0879bbe8b7051eebef5b09390fd1a9a931017d31f26fcbbbe69fbe4bd6aed321011ae9c4d58dd8fe1f2beb136
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
872B
MD5205325410fa495d4698bdf3eb1c8cbdb
SHA119b15e123428a68c40ffbb45a7b9121d9c4cf02c
SHA2561b44137470248ad3f86dd32c5eaadb9a5dba52aea9ee18e9402b241b6a5f21a8
SHA5125f5ddbf601e91be0e5e4a1c5fe737c7c6eece4c812b78644a16dd3c5405acb3f03806bbe7ad0a873e371d3ecf94a06fe92a63294ac3ceaf1e4a813f1ffb918fd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5b754bf4a3289368116bd41986e46879a
SHA1d1229d14dbf9f2fe3cf7a188327e8556a7c827f3
SHA2565b59af082bf6f7a47a39ac1c78c1f0ed5a2ea76956f022ba8e8ab3854750a417
SHA51277e167d3dd5c3d7573cb1ba6962786fca97b6d46b446529379edbe9c04c61e951cae81028a35cb01bb9da9c8792dbeebefddd43afc6d6b5d66ca8310874ed6f1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5ba59a8ae3c4c1413e8a77d2ba8540a2d
SHA1751074bab3a064f240f74decee8b186ba165a7a6
SHA256e11c4ed7befd4cffd3e463aae3ca9fa1504eb39b19748863fdcaf216534dc799
SHA5122a0ed3dd751a63fd92220680d988116d47eb3cc9b236a000250252293b1e8d0e68bf24f659a09021b1252c7fed9b06f4da4d597f90c0e647537575b0b873b4b0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5eeef003b0a36e677bfd7a4aeabd70332
SHA187f11e8b81fc3880bb9fc9a6d03c35abceab9e3d
SHA2561ef8aa2e5d11742b8b0254570f9303037d2d85fe09728f09b4ef1140da9bda44
SHA51222bd405a23cc93060be1d78cfbe1ad68628d560a4a1aff78a2f0dbac4e7b9a52ed2ba613ddbc80b8c7d9d3ff0efdaf3d98da9e62dda0143400eed0ee73eae40f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
114KB
MD52c6879bb5ff639ad4e66a6ea7e89bb23
SHA1628f45a3ffd587a8ba6b3c927214495d1e0bc662
SHA2565a9b3be0251f6e85a21c16da6255d6f9ddf5181cfc9525f208c79900f8830f64
SHA512c9956a282e5e8fa11f87ff92c3cbe5095ca71c94bd5feef4ab7f66d6d3c0c0c3aa076d08fc3a24794a8963e7bc003b3119a354dce57fb9a7eee8729ce4e71480
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_3476_ODGBFPLCIJAIIDEBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e