Resubmissions
10/01/2024, 14:04
240110-rdhjhaggfj 110/01/2024, 13:54
240110-q7wgsagfer 110/01/2024, 13:50
240110-q5dtyshdh8 1Analysis
-
max time kernel
124s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 13:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://docs.google.com/drawings/d/1HvNzV8Wv4emELHegQkllOj-ucbIfTVOmos2PeW5Zuqk/preview#v9eo8awjpcp3us6qwx6fb0
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://docs.google.com/drawings/d/1HvNzV8Wv4emELHegQkllOj-ucbIfTVOmos2PeW5Zuqk/preview#v9eo8awjpcp3us6qwx6fb0
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://docs.google.com/drawings/d/1HvNzV8Wv4emELHegQkllOj-ucbIfTVOmos2PeW5Zuqk/preview#v9eo8awjpcp3us6qwx6fb0
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133493685035024583" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1564 chrome.exe 1564 chrome.exe 3208 Process not Found 3208 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1564 chrome.exe 1564 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeCreatePagefilePrivilege 1564 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1564 wrote to memory of 4960 1564 chrome.exe 14 PID 1564 wrote to memory of 4960 1564 chrome.exe 14 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 4704 1564 chrome.exe 31 PID 1564 wrote to memory of 1900 1564 chrome.exe 30 PID 1564 wrote to memory of 1900 1564 chrome.exe 30 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25 PID 1564 wrote to memory of 1400 1564 chrome.exe 25
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbbec9758,0x7ffdbbec9768,0x7ffdbbec97781⤵PID:4960
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/drawings/d/1HvNzV8Wv4emELHegQkllOj-ucbIfTVOmos2PeW5Zuqk/preview#v9eo8awjpcp3us6qwx6fb01⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1892,i,2152328632384976862,17102958437882854754,131072 /prefetch:82⤵PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1892,i,2152328632384976862,17102958437882854754,131072 /prefetch:12⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1892,i,2152328632384976862,17102958437882854754,131072 /prefetch:12⤵PID:4084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1892,i,2152328632384976862,17102958437882854754,131072 /prefetch:82⤵PID:1900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1892,i,2152328632384976862,17102958437882854754,131072 /prefetch:22⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1892,i,2152328632384976862,17102958437882854754,131072 /prefetch:82⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1892,i,2152328632384976862,17102958437882854754,131072 /prefetch:82⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2560 --field-trial-handle=1892,i,2152328632384976862,17102958437882854754,131072 /prefetch:22⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d1b547420339c5e8f6bf0d6427e9e045
SHA1b21b66e411237ff87c53847fded787eae0044a1b
SHA25664f8efe35e2c98769d9dbda76a7ed96be04201d8d6350b33ab32bbfbec2f2419
SHA512fb2c84f5e9b99850b6e16e1262ad2dd1ae04eb62859a6dd5ba28d3330b7b82cb236e1e420fdd2e8ff0b22cab09450d4945023a40e4bf860919755eb9d3931447
-
Filesize
6KB
MD59f81028a04a02dca48407cd5bc64d372
SHA10820589282237d71d0daf2e5fef761d510502c68
SHA256988a70cf75dc46acd16032558e749b8edfdea75db07d3673c3bd3c5a148a9686
SHA512857a89bfbe65debc707850f78cc62579ea035857331107417729aca1d7c93f4b0e2db34b8ff6d1dd995c43bd32794dcc4576b8f84217176b18d34c24d69d789c
-
Filesize
114KB
MD5a25f9af2c82d1dfd3903c28dc03f7663
SHA197e2117e9966efa5581f98d50c9e0c71f8483e3c
SHA2564b3fbdb595dcae9c8f3e6c873f32cf1e7117e8a672d4c256e9f2c8b30d65468f
SHA512106e8cef41847e9879d213f483784f8804e29d8ce0bece4d5abfbec5d9c2ab042c38d59b39f9ae856b298dfb7c8f9d20387679e2ff81b05b885e6c2f98d474c8
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd