Analysis
-
max time kernel
102s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-it -
resource tags
arch:x64arch:x86image:win10v2004-20231215-itlocale:it-itos:windows10-2004-x64systemwindows -
submitted
12-01-2024 13:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://fpno4qycd1ud-1323563947.cos.sa-saopaulo.myqcloud.com/fpno4qycd1ud.html
Resource
win10v2004-20231215-it
General
-
Target
https://fpno4qycd1ud-1323563947.cos.sa-saopaulo.myqcloud.com/fpno4qycd1ud.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133495386479148474" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 740 chrome.exe 740 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 740 chrome.exe 740 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe Token: SeShutdownPrivilege 740 chrome.exe Token: SeCreatePagefilePrivilege 740 chrome.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
chrome.exepid process 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe -
Suspicious use of SendNotifyMessage 26 IoCs
Processes:
chrome.exepid process 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe 740 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 740 wrote to memory of 1364 740 chrome.exe chrome.exe PID 740 wrote to memory of 1364 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 1188 740 chrome.exe chrome.exe PID 740 wrote to memory of 4252 740 chrome.exe chrome.exe PID 740 wrote to memory of 4252 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe PID 740 wrote to memory of 2928 740 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fpno4qycd1ud-1323563947.cos.sa-saopaulo.myqcloud.com/fpno4qycd1ud.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0679758,0x7ff8c0679768,0x7ff8c06797782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1896,i,10810202040491441778,16167369617523646739,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1896,i,10810202040491441778,16167369617523646739,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1896,i,10810202040491441778,16167369617523646739,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1896,i,10810202040491441778,16167369617523646739,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1896,i,10810202040491441778,16167369617523646739,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 --field-trial-handle=1896,i,10810202040491441778,16167369617523646739,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1896,i,10810202040491441778,16167369617523646739,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506Filesize
330B
MD5442de34f806d1a323a64b4a53117a700
SHA1dc8877a0b210c6865a847de1abdb956446e1ad71
SHA256dfe2a149618ddb131b07bdad875259a8f8e82eea1f4c549d3e544fb7a1e0445a
SHA51247f28de18e0b9ac552f4b0b55eca3859945f4e6f6e33c010fd0de426dc3810931ea1801c2a5007b55243c1aa3af8b8b99ced4e0b40e7f0cb48039042731706e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
240B
MD5d46e28cb6dbe5019d3b2197ec050c1e9
SHA1adec47ab4287f29c3dc10500987ccf7bf2891487
SHA2568ab6fb83eeeb876cff821a93013bdb02282d8eca59a5d4aef0853fde27adcd90
SHA512205f4aba85474a4ce4c4534178e9aadc5b296502e64386d23b828a55984fc7a505ea101458fde9e0ad8e5288eb5c13ca56b35f97ca54cdfd1f795629d8166096
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5e16fd6f4b1561863338155aea1482b0b
SHA13ac474f2c74dee79a2960c0a3afd659391533199
SHA2561b6102610728e098b9996a65120b958284d659e2ec058d60c7eb998d73d621da
SHA5121a75359d9013b43110557c8f68d78423ab84bfc83f558b033f6b77a8ffe5ae62d519400867004039670583cdae6b8bce66edc2ab17ba836af4ba66326a32a228
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
874B
MD5e74db287cc0c8e8bd61135c1c305b09f
SHA12b601de1186779fb2174da5d7fa6f69998de3750
SHA25690f0b58c71313a5aa27d75e5ca8916036037bb6f1e313034198b05dc13b016c6
SHA51282e023763e96655d646ffbc7450db580dd2b2184aa1985e6816a8fca0eff8391dabd840672354b8693b02044a7668bbabd2293022753ee1b19730d3b98e2be42
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5ad9475096217a30f984e7cd7739dd459
SHA15009b53c4504dcb4eb5c2ddb85c5ab9e6d953659
SHA256bf52e686fdde6658817c4d10785b637f96688d0590097944a5566024efcdea06
SHA512c926d266a6bd20fd79cf3ddb4c3745f4f41ff46cb1a4eb12b6917c9f2b29431e46f56ac35922c476eafd9a9d463107270f9bb0d7796ce6a6888db2e4215e8039
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5426befca9aa4b9e768279f32571e4e61
SHA1b3016776c6997d474636981cfbbd1a197b3ae9ff
SHA256f46d865e924580087e9fe6c1ae551a71aa6b332a85f5b7bf515d879cc13b3d5c
SHA512d8df2cc5ce45c2db260ab1dbfadb757dc8df8f7978a8f208cddd5637ce2123f0d1cb4c3401691928143c175cad0c0761e797c836346d018252fef1022459f712
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5b4c55fa44dc3e682e6adb4fc4790b891
SHA17617bf7a4ba269147262ac52531cd77913049360
SHA256542add02bc3d868b12e4de8695de87d2a7765b8449a530b667b84e7ac67902c0
SHA512d2a95a0cfa8529ea5a162256220e9f3c7711cb4b22d88ba2a0ca6c6ee848708e62fd4c922735a990cb857afdce953c65d2ed724ff99a7bc6fa3d17fddb84b252
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5d4cd6d94b4b21739f98b96778c222111
SHA1d293d1f2d1576de27f2075ce5c33557f631728ee
SHA256c994e11cd41188cb7e4213e223b0fbb595b8c3541486bc51eaf7e2e2e4274b2b
SHA512a8483f091b10762d9c7c15e14e5a56ae982e58c22c404a35e3fb7e8e1dd93285400a85d461697d015cc68e23593de341e37e39b7b7fc6287368c52b645c7e4c1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
114KB
MD563c9af936559a40f8f7cb78805ebc686
SHA1dbc0d12349f451d39c9d0acc9a116fc77922de7b
SHA2560c44f83bc01f7d4dba24e5d7026b45a42644c5f8b912fedc6d8063cfe692432a
SHA5127b328158404fa2cf67c0019311443f89d2236806925e9ff32c1d816d30befe89b3e306fdb2c6ac236c9eaa9364e16dd0ba97facc026cd39689b78fb0731dcc6d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\pipe\crashpad_740_HIZMDQOJCAVMUGGBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e