Analysis
-
max time kernel
59s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2024 21:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://securemail.dsh.ca.gov/securereader/help.jsf?lang=enus
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
60 seconds
General
-
Target
https://securemail.dsh.ca.gov/securereader/help.jsf?lang=enus
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133488771380864058" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1596 chrome.exe 1596 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1596 chrome.exe 1596 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1552 1596 chrome.exe 18 PID 1596 wrote to memory of 1552 1596 chrome.exe 18 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2436 1596 chrome.exe 94 PID 1596 wrote to memory of 2108 1596 chrome.exe 96 PID 1596 wrote to memory of 2108 1596 chrome.exe 96 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95 PID 1596 wrote to memory of 1872 1596 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://securemail.dsh.ca.gov/securereader/help.jsf?lang=enus1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff954789758,0x7ff954789768,0x7ff9547897782⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1760,i,1075653154077576137,16290002041361475550,131072 /prefetch:22⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1760,i,1075653154077576137,16290002041361475550,131072 /prefetch:82⤵PID:1872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1760,i,1075653154077576137,16290002041361475550,131072 /prefetch:82⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1760,i,1075653154077576137,16290002041361475550,131072 /prefetch:12⤵PID:976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1760,i,1075653154077576137,16290002041361475550,131072 /prefetch:12⤵PID:3896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1760,i,1075653154077576137,16290002041361475550,131072 /prefetch:82⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1760,i,1075653154077576137,16290002041361475550,131072 /prefetch:82⤵PID:2448
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536B
MD51b42bc1a84346f238bd4b9682a3865be
SHA14049357efe5b1ab6be8c07fcb03bda69f345f1ca
SHA2567845af13a64718f085b33ce3e3aa1e49ee44144500a295241d40f50d3ca80673
SHA512c8816eb8db7c13f900df12917efa3cf0893a0ac9cff48c577505dd4b18bf4138e809524b18ba2c03f28c5588c765eb5b291726d963269dbabe69a184ec49706d
-
Filesize
6KB
MD58d962ccd6b1f010ef6c23e2c827c80a1
SHA1e576479122609e7641848c680d4570075c22483d
SHA25602282591724cd7a82e80527936c5b0e88495641bdd338018dcad2914f64c89e1
SHA512b243aa9b88b7871d9d7d51fe157e869163da31065017ac72e03a3d7706cce767ad6c28f48cc177ecf9fcc88fedbea8ab4452326970f7c43d62f2505ea544566d
-
Filesize
114KB
MD51163a2c2dabf6273a0d065015a71987c
SHA10515766b78863930296b6293adebf08f36f81f6f
SHA2568068b8ddbdd6bfe82737ece76c9c1a51154493e6ad0666763b3874039e0cf27c
SHA512ae379b01511cd23163e66fd503f0d1c0de1c3884576abe307cd9c55e6c7a34004c26128f329b5fa67a1d707eeb39b6a5c7aa705aed20890579e9afc66bd6fd24
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd