Analysis
-
max time kernel
299s -
max time network
295s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
12-01-2024 08:40
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://shorten.ee/BDO_ProtectAccount
Resource
win10-20231215-en
General
-
Target
https://shorten.ee/BDO_ProtectAccount
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133495224299714303" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 332 chrome.exe 332 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 1620 2284 chrome.exe 73 PID 2284 wrote to memory of 1620 2284 chrome.exe 73 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 2488 2284 chrome.exe 76 PID 2284 wrote to memory of 4512 2284 chrome.exe 75 PID 2284 wrote to memory of 4512 2284 chrome.exe 75 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77 PID 2284 wrote to memory of 2316 2284 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shorten.ee/BDO_ProtectAccount1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdf6599758,0x7ffdf6599768,0x7ffdf65997782⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:82⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:22⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2132 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:82⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:12⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:12⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4800 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:12⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:82⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:82⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:82⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:82⤵PID:3312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1884,i,12087449765145680170,9686337631275022768,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:332
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55a5440e659752d4310d00129c62ca61a
SHA129b1c9155e6457d10110bb0b624112ac718c2101
SHA256d8d4b1e17013b3ee02408ccce79ff8e1e31d018c412b5767baa5a2ad2f6577b3
SHA5124cb91a98607aa6535ad8153620fb1b0a311201cc1b392fd49b2b53922818f17f6ca2a7718906ba9ff7a7f1781e06801ca5468ebf4fbc78a017c1799a302d8dfb
-
Filesize
1KB
MD5ab82c54c409c0b1f54e92497b85020ef
SHA19e9d7c5b3815882cf05675576af7d4703130a7f2
SHA256c05aac7947324406240158f831aac84a777174a464b6ad17d03cad4e72c41aff
SHA5122143735dfa833a617e91ea6223783e5797f1408e1a7cbce77cc80596f4ea01c72a066a33f88adf02e29be5d6e6f953dcb558db4214ae7452b681e1ad69573e86
-
Filesize
5KB
MD52ec69f5de524c61b81f105654e3e69a7
SHA1c2da4a4d57671e3b41ef62135994e2a76e74782b
SHA25692d823f9fadaa38ddff214b72c30294ec4bd0be86e3590063b04e1a99058053f
SHA512650d05883b8e11b3cd469f4755bcb4c34e6aeeac493110a1447251b34989ed0645c02bbea8f79d670cdf2a79533409f8396bbf5f4e2954a43afcc627ef9d2bcb
-
Filesize
6KB
MD55596b646c61350dc05bfa379cbafbc4f
SHA1294afcb97c5ee11d1ece4be7bba9858b4407e396
SHA256c96c71534c7c613ab60990c3a428a0166196196a7894bd783c363cb84db8f501
SHA512ac31020443b9b8ade028ab4647bf6823d5c1dfd560317b11cd39152ba8c3d3fdc9d7c7bfce424593e75c31ac266ae90cb28719f999a52a6de4b54e3834e6a8c6
-
Filesize
5KB
MD524f7f189f97ae3c2666c31511851b02e
SHA11965de5be9fc762be3cd3d86942110ebf61cf12a
SHA256e5087f9628d91cbb675d199a1d88247f40f7fe7ec5bd468671063c7f1496c728
SHA51200695dab66a1fc644e757a618ac46dac906d477ca7bbf0bc8bdb376a1c53676c42dbbbf5828d73935b9033f831dbf2ccf5c05be02673ef923b4252c8cac08e5a
-
Filesize
116KB
MD524f6fa20319bd0a0cda96e42c73b49e6
SHA1435c3d80c0258ecca766b07daa17ee2dab6f0dcb
SHA256f6613663c3f10fff3f3988220a73a657a8e0ff5cad59f64b18627695c1575cbf
SHA5129f500a5b358b66ec20072d59e8088d0f2a77c58ae764c75cac41afbaed7913597dcaf6365633c7c48cbc2eb4104639c0a601daa2fbf44a90ab02e8dd7eaccf3c
-
Filesize
115KB
MD5c9373999769cd83e7baa6240dfe5132a
SHA1942bccf31391fb53b461060d55912e175f6da25f
SHA2567f4768ecccebd280dbb22090d514636d548e1d10665349d7a087287b4e1b5800
SHA51260db91a9509b8113ca1920deb01e65f08c2e70ba019602a65a811f74ea34435133922650066380f5a1e8db20aaef7c19cda2db36685494814b3b407fa939210f
-
Filesize
133KB
MD5904eb8124252b01f9c57ac5fb297677b
SHA13beabe4adb5168c4dc3450adb8a533f7cfaf6c0d
SHA256438fdea4da6984731111f84ebab001ecfa9a9fc6c23b40bc69ac08925c51d1ad
SHA512cb152362c87166e51c1cc5b45fdce6632d2c896f97d746ac4a409524037e7fa147f8fc1a89fd19dc552e9e7de4115645f926c8e851111702d6f85e7d8a06c339
-
Filesize
115KB
MD563fdd73d8f1c084b5f0e639995de0ada
SHA17576e578dd7a1bba94219d78934f9e2e5123ddf9
SHA256f2314736f3b53bc913748e23f80c5bbdd1d22e9ec4793e143e38011f83c827f6
SHA512fcff6b5701862923f575623938e4687aff98db3e1e136c606502401b70903009af7264de315f27989a8c8800cbefe089607443c71889f80c602ec028398b0b75
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd