Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 07:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ivalua.estatesis.com/page.aspx/en/usr/login/error.html?aspxerrorpath=/page.aspx/en/usr/login
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://ivalua.estatesis.com/page.aspx/en/usr/login/error.html?aspxerrorpath=/page.aspx/en/usr/login
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://ivalua.estatesis.com/page.aspx/en/usr/login/error.html?aspxerrorpath=/page.aspx/en/usr/login
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133494332665942875" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2520 chrome.exe 2520 chrome.exe 1680 chrome.exe 1680 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2520 chrome.exe 2520 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe Token: SeShutdownPrivilege 2520 chrome.exe Token: SeCreatePagefilePrivilege 2520 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe 2520 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 4848 2520 chrome.exe 16 PID 2520 wrote to memory of 4848 2520 chrome.exe 16 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1772 2520 chrome.exe 29 PID 2520 wrote to memory of 1828 2520 chrome.exe 28 PID 2520 wrote to memory of 1828 2520 chrome.exe 28 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27 PID 2520 wrote to memory of 3648 2520 chrome.exe 27
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff826b99758,0x7ff826b99768,0x7ff826b997781⤵PID:4848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ivalua.estatesis.com/page.aspx/en/usr/login/error.html?aspxerrorpath=/page.aspx/en/usr/login1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1776,i,4721287787245564739,8941283931601250169,131072 /prefetch:12⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1776,i,4721287787245564739,8941283931601250169,131072 /prefetch:12⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1776,i,4721287787245564739,8941283931601250169,131072 /prefetch:82⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1776,i,4721287787245564739,8941283931601250169,131072 /prefetch:82⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1776,i,4721287787245564739,8941283931601250169,131072 /prefetch:22⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1776,i,4721287787245564739,8941283931601250169,131072 /prefetch:82⤵PID:1140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1776,i,4721287787245564739,8941283931601250169,131072 /prefetch:82⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 --field-trial-handle=1776,i,4721287787245564739,8941283931601250169,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c686702634603eaab9c7ff471ea5e3b1
SHA19458ac1b006d9f30ee9070daaf017b324c9ec8da
SHA256e53b8f6d0cba73dd2a745d0053cc007af1d47cfd2627a9bf5c2018677ea1654b
SHA512a0061ce20a276822e696660c96efa917e0731369864938db1012798d0de9de6a7b38f665a843c0aba2ce0b074ca1d34911c2f186e602fa88c4036dbee6561ad4
-
Filesize
6KB
MD5ed0294f5070a2d97bd8a7dcd888f4243
SHA1702b39b8b35a3c00098ec8bbe2cbc5d47c9ff9ae
SHA2561e2d377a35e74b58ec4d77a169c00a0b64b9c2f92d0357d10a4ad100a0b492ae
SHA5122e9be44d260a75b669a90702819041ce9219f5fa624bfaf2688626086cfac6117f45c1b11df2170146d48c6d152e441a5ae906d171d5c1914175b4bff2f51c97
-
Filesize
18KB
MD5d4026a0f19739ce23e82453ed51c89fe
SHA1f71c8c630cd37df65cdc6262f3be0bfe6aa582cb
SHA2566131f7bda05e921325033e3e928ae878c6580baf88ba05811103deba805cbd9f
SHA5122e9701e9f64b48798ccdffc7b0bec63f85a639a2a5d802bb12da6ca5be7c1c15126bdf6270c5b0d0f86b075856ae439a95dd9f8c3c4bb6be5a63e8254f917665
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd