Analysis
-
max time kernel
42s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 14:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://explore.igloosoftware.com/subscription-preferences.html
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://explore.igloosoftware.com/subscription-preferences.html
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://explore.igloosoftware.com/subscription-preferences.html
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133474690896982967" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4844 chrome.exe 4844 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4844 chrome.exe 4844 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4844 wrote to memory of 2512 4844 chrome.exe 38 PID 4844 wrote to memory of 2512 4844 chrome.exe 38 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2248 4844 chrome.exe 92 PID 4844 wrote to memory of 2204 4844 chrome.exe 94 PID 4844 wrote to memory of 2204 4844 chrome.exe 94 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93 PID 4844 wrote to memory of 1604 4844 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://explore.igloosoftware.com/subscription-preferences.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3e039758,0x7ffb3e039768,0x7ffb3e0397782⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1844,i,15665240743072644502,9131515174676986450,131072 /prefetch:22⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1844,i,15665240743072644502,9131515174676986450,131072 /prefetch:82⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1844,i,15665240743072644502,9131515174676986450,131072 /prefetch:82⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1844,i,15665240743072644502,9131515174676986450,131072 /prefetch:12⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1844,i,15665240743072644502,9131515174676986450,131072 /prefetch:12⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1844,i,15665240743072644502,9131515174676986450,131072 /prefetch:82⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1844,i,15665240743072644502,9131515174676986450,131072 /prefetch:82⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5cce439c28a443fc4849f10c28a85d7ff
SHA10e2580249cb0133c2311efb520d5886777dd7d38
SHA25655af822ad9c82c7165092d3f7051106e69b1ceb01132d4f7845ce7671f34745f
SHA512d34d3c1e1af1e313f4d439f39418926b53c696130e00604e98d7512683987de5f1e13e0d5bec0295a6ff8934bcf65a555dc897803c2e827206662b1982c1a057
-
Filesize
6KB
MD5b25582fd5e6b4d5c73c1bf385f819756
SHA1eb2df25d4c7b3f83fac04e662b4ca8f67de6750d
SHA25689353e7ecc98b4e8c9a8094bab3377f57b816f103859e0ecbb24c10e7c4d4afb
SHA512f77de86524222cf18f8aaede3f9ff5457f759fed8a9cd92f8aca46930ba66d8fdc45281e68cf752fa3eb02650dbe025440d1ef9217fe4fab72702f1d38ec49b6
-
Filesize
114KB
MD5dd4ab50bbe93d4ecbad0b7cd520cd4bc
SHA1993355e8990cb0028c6f8fd10f95263e535195e7
SHA256a8829b5fc7d2224aa6b9b801ac8fb6e7862ff75cdbf534540b463026d7271e00
SHA512235677f51f4274514dfa4431c5b840c7b3ae336f109cb14b6cdba70b82cb7733e5504ccbf7ad807fee69d794059d598bea89d20ce1cb89a653c84c0632364bd0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd