Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2024, 23:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://dv.clinch.co
Resource
win10v2004-20231215-en
General
-
Target
http://dv.clinch.co
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133489696879427317" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2588 chrome.exe 2588 chrome.exe 1724 chrome.exe 1724 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeCreatePagefilePrivilege 2588 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2588 wrote to memory of 4768 2588 chrome.exe 14 PID 2588 wrote to memory of 4768 2588 chrome.exe 14 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 1640 2588 chrome.exe 29 PID 2588 wrote to memory of 4440 2588 chrome.exe 28 PID 2588 wrote to memory of 4440 2588 chrome.exe 28 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24 PID 2588 wrote to memory of 4860 2588 chrome.exe 24
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98d819758,0x7ff98d819768,0x7ff98d8197781⤵PID:4768
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dv.clinch.co1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2756 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:12⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2764 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:12⤵PID:1932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:82⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:82⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:22⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5048 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:12⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5040 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:12⤵PID:2912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5028 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:12⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:82⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:82⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1872,i,10313694102119531767,15580581417783060590,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD56ee6b628d4bf3bb9fdf5bc0a7235e54b
SHA1845acef50324d1e2d44cf7dae41ff93862f05f26
SHA256023fa5cec0d6c9559427180931935dc9af260354f658cd8bf6f44d0e3614943a
SHA512eb50fb0a717745a8ad2a6b65e6a47d8bf23bfc6bf1bdf8fdb9523aa12f723f02110c85c890f1e03ecbd9164c03fe76ed04ba9c5680218d21a8eadf25cb7dbe66
-
Filesize
312B
MD5982c55d3eabb37260199139109f68d1a
SHA1e330e785869cd620e0be747cbe43fa8c985613e4
SHA256518a7775cd1e86c48ee6705735921cb2043eb051306c8a7a9df41255f095460b
SHA512b7a5414eb6f98fe05c0c65a95057d1f01c80d91dcfe106ba5fb774b242c66351697341e4c10e2731b19054321ccf6664189004c19e7d1f6df94f1802244a4eb2
-
Filesize
1KB
MD53dd818313ad4acb4cadc7c884f9c8708
SHA1eac57744f6acc9dbeeb26f5cf4a63a4047686eb2
SHA256b6a90879724ccdfa0d3a4647d67f4faa441bfe24207ed9d67bfde20992aa2942
SHA512812c0d6446537d339dc5112607d8ad9e2d9caad1a00def89a71d5f711b7b3673ce1f29124c181654eaec94c8d6af62ec3dca279ba15a3ffdad6987213ae22d25
-
Filesize
1KB
MD5f544e14fef4f7f92f3df8f114c5b2e6a
SHA1e75079bff07b7052c5a79d3a716a7af87b974bf8
SHA2561110594c46368719dd4d8acbd4939feb9b8db7acec805411631da9752eac3900
SHA5128c16911ba3ebc913c4aaa9ccc96ae61297ed7beac2c2dbe9525db2fa503d4b5dccc6baa96b48b2243f703c621dbbc8f5a0e53f71704d044be6350f4093a9eac9
-
Filesize
6KB
MD5e0c7d5732ef0b8a8db47fe1ce0fa8d90
SHA115226ac8b92c300f3cb8c74a54762ac8e978459e
SHA25634229fac5708ff622f0799a2cb3b87bf1ebf18ef31ea7adea1618969fdb14052
SHA512f8169253393b2fa72aad3a1307fff43bf3fe9529bfdf9a1043f9e9f02ac1458c4d2fd2185745129960a1fbd252f817efdfa34d05cb4d60bc3bd46f384380e30d
-
Filesize
6KB
MD55044681b43a12f3341f68ce149ecb395
SHA1a2fb57734ef98d70a5d5814a90ed47911ca24752
SHA256fd85a2320561eead9dce792c01ac5eafb7a6a9bbcfa9f79925b59e81af2965c7
SHA512a8aaddc7c839f30191399776df86b7996bf2e99cdc44494d1d66a31b75fffd75214956de659862c450797c7190a7644531b82a146380b5cbd2d297a82943f90b
-
Filesize
6KB
MD5a3372c9ee9e5ffe958bbd79ba73a0840
SHA128e88eccc9b6a18b345a7a63c075769246f643ee
SHA256a3738e0562a29a63e6c7eb19dd8267244e58b698933d01618dcfc6556e02e084
SHA512f78a62004b949e89723e0b8e2e2c266e6c3e300397a356f407ceace6a4ed9643395c1a74a908b0b960fe51bd49910a56f136aba4d2d004b465fe3f6e1941f22e
-
Filesize
114KB
MD587d3fc2bc3ada3037b95174a2060ad6a
SHA197619df8d0537fe873a0415ab1a293a86df54aad
SHA256b863b1cc3160d87db9097e1c49e5fb9b62b0dc220ea882e5f84acdc9fcf2ee3c
SHA5128c3eb20fb632130728e8097d7f74acb78a9c8fa14ad5487fb25d5e0ebf164b385b037f312ebe605aa59dc1ba6f14e8e183421685d2776f2376a6a8e491ec62bb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd