Analysis
-
max time kernel
301s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2024, 18:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cablevisionhd.com/
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://cablevisionhd.com/
Resource
win10v2004-20231215-en
General
-
Target
https://cablevisionhd.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133486941019250318" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2920 chrome.exe 2920 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe Token: SeShutdownPrivilege 2920 chrome.exe Token: SeCreatePagefilePrivilege 2920 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe 2920 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2920 wrote to memory of 5104 2920 chrome.exe 58 PID 2920 wrote to memory of 5104 2920 chrome.exe 58 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 5060 2920 chrome.exe 90 PID 2920 wrote to memory of 2032 2920 chrome.exe 91 PID 2920 wrote to memory of 2032 2920 chrome.exe 91 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92 PID 2920 wrote to memory of 3908 2920 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cablevisionhd.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c8339758,0x7ff8c8339768,0x7ff8c83397782⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1876,i,6664001042312331852,6663053076673452022,131072 /prefetch:22⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1876,i,6664001042312331852,6663053076673452022,131072 /prefetch:82⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2128 --field-trial-handle=1876,i,6664001042312331852,6663053076673452022,131072 /prefetch:82⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1876,i,6664001042312331852,6663053076673452022,131072 /prefetch:12⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1876,i,6664001042312331852,6663053076673452022,131072 /prefetch:12⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4916 --field-trial-handle=1876,i,6664001042312331852,6663053076673452022,131072 /prefetch:12⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 --field-trial-handle=1876,i,6664001042312331852,6663053076673452022,131072 /prefetch:82⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 --field-trial-handle=1876,i,6664001042312331852,6663053076673452022,131072 /prefetch:82⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2876 --field-trial-handle=1876,i,6664001042312331852,6663053076673452022,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1804
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5c3add1a0ceed2076738773f724b55b77
SHA1abcd4a196a68a7d827fb0b8f8bc6d3419010de29
SHA2563ca9ebbca76768faa5cb8efdfa49cfd3ed3ef6fe26d82ce36450b3477ac57cfb
SHA51205b914428e49b07a494e45ae57f81237c6966bb8f45cbf224d5aa1bce1eb72313bf98be3887de130cfedde0c0de346494cef238c25933316bad02b4396ffddad
-
Filesize
480B
MD5c6c2d0f7acb50b7394d8a65ec020e84b
SHA151f0d6b0a0278971399502c2941667b2063972f2
SHA25667c8c29b298ad0e5359b3ea9124f6743c8c9c0ad6da5fef1ca431d852ff510c2
SHA51253548d4a360f16fe57f9a19dd052ff2001e4077bd4e5c4fd84bb4ddfb62d98bdd38477bd20bcac9b3aeab37e46dfacbf92c2357c64b43d0aef0383b2d13a31dd
-
Filesize
1KB
MD5ab8c92bd55462b03b3b23bcea0d299cd
SHA14c41f6943a3f998a5125dbaac08d4466cb1f9487
SHA25644f47f7575aaba02c1d9d227734dbdf7df9c7874eb05ebc136e3fddfeae74911
SHA5127cc740ead96a402ce9fa622ae68dfca240c21886c1c6806dc4f9d7bcaa3a6ba25b80f257b4135e9c1445947a3790619313f14260b2599a8f3fc4c1b7476e5e36
-
Filesize
5KB
MD5c48440f395d88bcac93e4ba8e58a055c
SHA14500dc15b86ea9c58b43c85e9c4e684d937c0522
SHA256ced43faa5970c43a9ececf492f9291aee2babf2ba65c00c950aa591100cbb3e5
SHA51207e50e458dd88bf9dd94fbd4b78be23464ed6d03e56634b016236836499f4a0042cb42bf4ebbfc94f1187a04f3a76b76764a694ba496ae7639ed96b700ae2d28
-
Filesize
4KB
MD57eeac452a38af77425794f54ddf4dfb3
SHA1de24461f244832a56181985353c550335abb2c6d
SHA256ce47848b97ea2ede230f67778379e5d693903c45cbad5f3dfde242a021c6ccdd
SHA512443dabed68fb685cd8eb1c4d4ba937624f4d54eba2b1a711516d75c3e1a6d7533351e2df01c500b85002fce2231d28e00f01c8436d6dd54ed4c6dd6a862e7024
-
Filesize
704B
MD5a16d204534412787b155b30d913d081d
SHA15c820e20acbae00b594e14a3a1e3692cde1a6b64
SHA25679603e9970180374a3535c6793072056d1e778f39e20859ac93963d938043151
SHA512e39d90072a62c2773f5b892a15d2efa4081c1d3f6c681d6dc49e17ed0d5b2031863764e7050f376b30e228785fdbc3970abfa19ff0aaf0bfb61a6ec460cb0870
-
Filesize
1KB
MD5a9fc528d8ea8dd460a2cd0b146561e49
SHA14aec4e024f8f2b4c1192ddf289934de95cd9755c
SHA256d24f67119c5687432e36aa35d008e102738ce2889d48e7b479b05d9bc4628ab0
SHA512fd54c5355da02e73c589f48f93217433889cdb79e07fe54946f1e0887acf168d6bd57120e95daba970ac986bfd4fb5cc68b8c0f0caedad859ef0e7f48267161f
-
Filesize
1KB
MD57457a12f455252f75bcd317cda67c4c7
SHA19df6f7a6eeff170dfc9eb849feb3f329fab182c6
SHA2564c1dc6a46dde6cf7666ba8f7f90510b797d31e24291c595bb193220a64889c07
SHA512b2ccf0689a857d890d25447afe48bcf8344e2ab78feef627227ee060985fe99063e871fc8a5c244a9b4fb90ed3d5ee7249850f6b677b07932b71bb3f32e2d7dd
-
Filesize
6KB
MD52d37b797b200711357d8acaa751cd3af
SHA18b913edeabe74d906a39c8b3d62bc745bc835466
SHA256b566fcf8351505b9be1832a8da8bc7dac258c5144afb6491ffea910f7efe07d6
SHA512e589e4924d1b9fc3ddd2f8710772c0977c0a1b2fc2ce8bdb134da860a68e3aa8d817e040111691a5ed2ddc682e3e438894f6e56994287ff0fa2456e1d8d336f9
-
Filesize
114KB
MD5aad123eedc5c8ed6b10ba5a723f781db
SHA1025510cc1b780aeda84376f62ce57acc8ddbe917
SHA256b1b1e56e7ea67e58f3c3a8e9d1307c4744cc84225e410e5f12adeccf1f60b048
SHA51294bd03bcb6a597d0839578491a9839ed06502c5b2b57d653010ba7e52619b8a9e2115dd24cd03b42e55f340504eb2007f6352c714dbc103b9788ba6e1913e94f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd