Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-12-2023 14:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://yasmine-18.lorine71976.buzz/l/3t9QIAv
Resource
win11-20231215-en
General
-
Target
https://yasmine-18.lorine71976.buzz/l/3t9QIAv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133474710966164211" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3360 chrome.exe 3360 chrome.exe 2444 chrome.exe 2444 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3360 wrote to memory of 1392 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 1392 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4584 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4676 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 4676 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe PID 3360 wrote to memory of 2928 3360 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://yasmine-18.lorine71976.buzz/l/3t9QIAv1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed8319758,0x7ffed8319768,0x7ffed83197782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1764,i,862787888700036879,10069897892865896963,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1764,i,862787888700036879,10069897892865896963,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 --field-trial-handle=1764,i,862787888700036879,10069897892865896963,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1764,i,862787888700036879,10069897892865896963,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1764,i,862787888700036879,10069897892865896963,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3812 --field-trial-handle=1764,i,862787888700036879,10069897892865896963,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3264 --field-trial-handle=1764,i,862787888700036879,10069897892865896963,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1764,i,862787888700036879,10069897892865896963,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 --field-trial-handle=1764,i,862787888700036879,10069897892865896963,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD5b65092348ca1de3661408c5ecb12c6a3
SHA1148623931cda8398e1ceaf37a7cc72f3226c6e7a
SHA2569c17de112f938ac41022ccd198503cc1c06ea580231b824633048b51fab6e8a8
SHA512932f6fbebbb497eb8a9430b128fbf535414e94591afbd91e40154bd608cc507807bf967e5bd20019bd2595cfebc46f53d815bcf4243972b8f55e6ffca8cbb833
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD52e2eb9a979c72e0d4b6f90b7d8df2049
SHA144e039b52ab49deb351260bee43362b321e446ba
SHA2566ba220784b7c665318627345e235ba127e2780b4adabdf08ea3443a54418a0fa
SHA51227360355513a6f938f6833fd1e668616a70964ee1b29a490f97ea38ba2deb36ff40a38e6a7a64fe5d35afd73400060153120741d92c1f0e612c599882b729a7e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
706B
MD52c47a546d92f00578059ccca1ab20036
SHA1656b0cf983c1ec2eb6406350869ce119389e5c72
SHA256e2ae65b936fce46d452a78067974a6814b4835a89c84a7d4b2e1e079bb617ea0
SHA512b92075e0ecb42d570eabaf7b86b62588abd440beb348a5b8445f1ba7067d3dae74d09c51447be4175a538912cd2ce8ed7740fa37c0bdea6db4af40500691b621
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5637591408bcc1b00b00d7f0ba8dd05c5
SHA1c8ec5d955762626a4594b59e9c478076e2351424
SHA2566a8af0ab3d2efa8342586eaa5129ee42fe5bc749c86583dea9988d8d9367674c
SHA51238bb73e87c92c9af5f61987dc6bb54adeb8b1b2a502b362ac1452cbf3fcef2ad1d0bf0a210735906d6088a78f92f26d11957603e43a0016eafb7b3ba630d09f4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
114KB
MD5d9619cb50b84f4dc9363b22e85b066a9
SHA1ad03b21aba2152995ba54065923b2162baa3ce8a
SHA25659cc7236013f8f688a374aa1b4271e8664d2bf551ec5d6845a82603bebd72e20
SHA512a0ec5f639e75d4fbc6a08df8dbcf0c16d44e3e123da268b08612cec4a9b49b74770d6e52871066b0f5570a3670ebabc50ca6fb6e4c2ca53b8b9bede529e9335a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_3360_OOELJFERBYTMMEPYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e