Analysis
-
max time kernel
300s -
max time network
297s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 08:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://security.microsoft.com/userSubmissionsReportMessage
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
https://security.microsoft.com/userSubmissionsReportMessage
Resource
android-33-x64-arm64-20231215-en
General
-
Target
https://security.microsoft.com/userSubmissionsReportMessage
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133492617690581455" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 3520 chrome.exe 3520 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5072 wrote to memory of 2968 5072 chrome.exe 61 PID 5072 wrote to memory of 2968 5072 chrome.exe 61 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 4248 5072 chrome.exe 91 PID 5072 wrote to memory of 2016 5072 chrome.exe 90 PID 5072 wrote to memory of 2016 5072 chrome.exe 90 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92 PID 5072 wrote to memory of 1584 5072 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://security.microsoft.com/userSubmissionsReportMessage1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb91f9758,0x7ffdb91f9768,0x7ffdb91f97782⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:82⤵PID:2016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:22⤵PID:4248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:82⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:12⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:12⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:12⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:82⤵PID:1280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:82⤵PID:4084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:82⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:82⤵PID:32
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6e177537-5e99-4b74-832c-eb5ef6aa29ae.tmp
Filesize6KB
MD5c9a80653b88ab389865896db90424033
SHA112de65fd3f4387869221c3385c797be9a0c863e9
SHA25651f85061ae68137e84f96d4a756f63ff100d6215a89e629960d0b43ea7de4814
SHA5128387d04cafa7e2a047abb329bdb64f7b722ac4216dc080a516b5e2392f5eadfa8e858b27789de69e8d1c5b3528a72967f22ed87344a393c494ac6f13597a2a1d
-
Filesize
168B
MD514abf1d81429f2d679401c0c480c2867
SHA17e0913ac10cf683469c9c4f9ba9c93b99ba29da4
SHA2568ce3804a7194be5e485da8f46c528525ff566e2c630f8f8dd5d69c7afeac5fdd
SHA512543f32d310f6ad88829589d79bc8e6ef98ebfe47b4b0565641d15449b0b2f9487680cd661422148ac3d81be9e30191cdf33ed1ad530489128df3591f791c9b90
-
Filesize
2KB
MD5959675b8721f463b85ec382d0015afe5
SHA12739ec1ef89d2aab6cc72fca31235a82bd050060
SHA256e4676322d1dd74e45ff626bc6580beb0fee3862d4259b4d9df53f6dfab9e176b
SHA512b0ed5194ac6ae7077c42659b37899dd0bd57f8ba234c3f568516d13f787b940634bbfa4b0d57b7eae619b4296a674d552e0e357f1b53b00c9cbe642493b238b9
-
Filesize
873B
MD58157cebcde425233f1d7a728c1450b71
SHA1ba6f583094c1b0594b9596e0bf9e1796a657ab3e
SHA2565583f2f845855d4923ea0e596d0ef84ac6934618aa7c8c0bf7bd08be062799fd
SHA5129151c364d2f88685299ef818d4488ce74196fd6051237b6ced33ff040b0f6cd55788ad3042e7edfb3ef8dcaf31319d065c775234706a0d573478f5c620f99a4b
-
Filesize
116KB
MD57083c1aa6e1f027bd40177d43541bcb8
SHA1de9712b50dbe0a36b156eae2a1d90b77cdd454bd
SHA2567ebe11642f97b73a2f629b73e197ae3571469901e1f9fcc0ecefc9939516e789
SHA51234c6f71e6bb14e74e38577c48e7d302dda2e5caeb4b211f5d03ef685d6995cea6d51e4c10fb4114036e778385d14d6ad98f635875dc5104628aab01f84479118
-
Filesize
148KB
MD5ade25f25be28f7b97301c834d6c93229
SHA189f545e3186676d1d481870fced022b62bdbdb1e
SHA2560d83b385d34ca14e48b7839c7f033453a93a480d50beb9800f9c5c889a1cb64e
SHA5129b28cbff4303d9bbeb228ff9a2fe44deca6ea7efb25fc6f655dfe78804e0a229ac267ccf6c3e130a823ee1112e47601b8a5f848ccd2dfe4b401ede3abefa120f
-
Filesize
115KB
MD54f69cb572f88df62131735794f4cb799
SHA1c65be8942d604d9753642305b66a32617bc94515
SHA256cabac6d94e8d8d99e6675fadd19253dd090243819ae83d738371af4570438093
SHA512c98a6c73c899bda3d820ad92b0abcdaa31bd8ca8f00ac96f2fcccb825ad25a99d0fd5a7cceaecc1e98c410806334a6fb8ad00c960325a8f24675590981f55e76
-
Filesize
115KB
MD5bced60dc1d95ad64837223efdd274592
SHA166b4689535d240241e03d493c963f1aff9e14a04
SHA2565992b6fa39af760702fea3812ea522b0a24a3040c47c9eca3b5e03a3fd6d39c9
SHA512e536f78fac69d003a1c170982b6f54a07a9d34170f2f51ae3bdb2883f0c790d2c6c4a745a4f0d415d92e7ec8a0deebf5e66bb21eb86c9d3984b38790ecec35fa
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd