Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2024 16:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ns.useplus.org/ldf/xmp/1.0/
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://ns.useplus.org/ldf/xmp/1.0/
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://ns.useplus.org/ldf/xmp/1.0/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133489449189132005" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1308 chrome.exe 1308 chrome.exe 4232 chrome.exe 4232 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1308 chrome.exe 1308 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe Token: SeShutdownPrivilege 1308 chrome.exe Token: SeCreatePagefilePrivilege 1308 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe 1308 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1308 wrote to memory of 4764 1308 chrome.exe 89 PID 1308 wrote to memory of 4764 1308 chrome.exe 89 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 4720 1308 chrome.exe 92 PID 1308 wrote to memory of 3308 1308 chrome.exe 91 PID 1308 wrote to memory of 3308 1308 chrome.exe 91 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93 PID 1308 wrote to memory of 4708 1308 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ns.useplus.org/ldf/xmp/1.0/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef7819758,0x7ffef7819768,0x7ffef78197782⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1768 --field-trial-handle=1952,i,8183723799227608327,9918569253366725949,131072 /prefetch:82⤵PID:3308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1952,i,8183723799227608327,9918569253366725949,131072 /prefetch:22⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1800 --field-trial-handle=1952,i,8183723799227608327,9918569253366725949,131072 /prefetch:82⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1952,i,8183723799227608327,9918569253366725949,131072 /prefetch:12⤵PID:3176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1952,i,8183723799227608327,9918569253366725949,131072 /prefetch:12⤵PID:368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1952,i,8183723799227608327,9918569253366725949,131072 /prefetch:82⤵PID:3496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1952,i,8183723799227608327,9918569253366725949,131072 /prefetch:82⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2784 --field-trial-handle=1952,i,8183723799227608327,9918569253366725949,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4232
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55e70064ff0259b833ed48f2d5bf369f6
SHA1276fee2ab3dc20712a7d7b1607e4bababb7a235d
SHA256c483dd6bef2b04ff65f0900157e1958502841cddb96b32b7e4943e4113e9e697
SHA512457dc5ee97e6352a10475013e15aea335347adf9478a2dc9233e0c07ba13f0c00ddae46642bf4760e43b513f5afc95d867c44939dea013adc90ba5ff706d28c1
-
Filesize
6KB
MD5895c1500a0c889df7059986d7f747998
SHA1956e6924df1fb160b0b8f5320533f6ef2a4ce99f
SHA256433efe072e92f17a4157d6593d303e53d77e8f38cd5941707c91f9b751c06425
SHA512babe91d505ad414d2d7e4ce483c48c02881bf9630404ef3ef18a71faea8b78e7b8c213d5545a9887ddaa8e90254a1cca48fe2c9e98bd53b47d122f49130976f2
-
Filesize
114KB
MD52465d0f1cee3d124f8e81de5c939d40c
SHA11727e3d4469e34e5ae7cb10108a2e450193c67f1
SHA256e61e644a13e776fc2d9c2e5675ad840bbb24e08a35f9c0ee7ec66043ff0dcf7c
SHA5127ea99f34b5627f2aee49570257bd8e0eaf7fef0e1531e24817a60e561b79ece6480b83c7f5cc711572fedaea6b7918dd7e38d82a86d9e97cbfd3ff24557bcc50
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd