Analysis
-
max time kernel
1s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 21:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://zeroclampentice.com
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
http://zeroclampentice.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2408 chrome.exe 2408 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2408 chrome.exe 2408 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 3828 2408 chrome.exe 14 PID 2408 wrote to memory of 3828 2408 chrome.exe 14 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 1884 2408 chrome.exe 30 PID 2408 wrote to memory of 3576 2408 chrome.exe 28 PID 2408 wrote to memory of 3576 2408 chrome.exe 28 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22 PID 2408 wrote to memory of 4928 2408 chrome.exe 22
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade499758,0x7ffade499768,0x7ffade4997781⤵PID:3828
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://zeroclampentice.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1908,i,5454153063290484710,4377374408559297711,131072 /prefetch:82⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1908,i,5454153063290484710,4377374408559297711,131072 /prefetch:12⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1908,i,5454153063290484710,4377374408559297711,131072 /prefetch:12⤵PID:4252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1908,i,5454153063290484710,4377374408559297711,131072 /prefetch:82⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1908,i,5454153063290484710,4377374408559297711,131072 /prefetch:22⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4876 --field-trial-handle=1908,i,5454153063290484710,4377374408559297711,131072 /prefetch:12⤵PID:372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 --field-trial-handle=1908,i,5454153063290484710,4377374408559297711,131072 /prefetch:82⤵PID:4620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1908,i,5454153063290484710,4377374408559297711,131072 /prefetch:82⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2656 --field-trial-handle=1908,i,5454153063290484710,4377374408559297711,131072 /prefetch:22⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f9c3a73d4fe5d8ae5ce490f47ae4d295
SHA13c278919b17367d8b94d30e63d8affebeac4816c
SHA2564ad5790b929065a6effa01fef9205f5e6c2e368dcdf9864d8e35882d084d73f7
SHA512750b45a28fc0dd1ab69946997a61575ee2a0afda55cebb3ba078c187436d657f78972c0c16551ed12002cffa35e809d7b8fea18dd290fb589575e1946de12546