Analysis
-
max time kernel
97s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2024 03:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gomatchup.com/
Resource
win10v2004-20231215-en
General
-
Target
https://gomatchup.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133495898286346841" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5100 chrome.exe 5100 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5100 chrome.exe 5100 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5100 wrote to memory of 2304 5100 chrome.exe 88 PID 5100 wrote to memory of 2304 5100 chrome.exe 88 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 1628 5100 chrome.exe 92 PID 5100 wrote to memory of 3204 5100 chrome.exe 93 PID 5100 wrote to memory of 3204 5100 chrome.exe 93 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94 PID 5100 wrote to memory of 2800 5100 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gomatchup.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf7749758,0x7ffbf7749768,0x7ffbf77497782⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1880,i,5941200240747353930,9679513638228516795,131072 /prefetch:22⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,5941200240747353930,9679513638228516795,131072 /prefetch:82⤵PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1880,i,5941200240747353930,9679513638228516795,131072 /prefetch:82⤵PID:2800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3260 --field-trial-handle=1880,i,5941200240747353930,9679513638228516795,131072 /prefetch:12⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3236 --field-trial-handle=1880,i,5941200240747353930,9679513638228516795,131072 /prefetch:12⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1880,i,5941200240747353930,9679513638228516795,131072 /prefetch:82⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1880,i,5941200240747353930,9679513638228516795,131072 /prefetch:82⤵PID:1044
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480B
MD5b658736bcc03cc9e21cb804a1dc6413d
SHA14293555fa1c598bbf06dbb4d4fa3c28e72ccf120
SHA2562e7255738af79e18e84f726ff4f65e6e81553e868a5f3b673ab6a479ca8747a0
SHA512430a8a2f29bca37a8a09e89ae2dd64e2fdc77e37f07cad718529bbcda61b186e288a6ff53e30673399f9064b297ffa710c0c13f7b5582bc78e504cc536ee1a99
-
Filesize
672B
MD5de3775b0ec1c36371b13ae0c0bf2e8a8
SHA172e67f92705f6dfc5dd5389211fa3e2aa9405dab
SHA2567778330e4d18f91d7940ebf679fb21917588af523f3a7d20399ae0933591fdc6
SHA5129e8b71eda547fc87edb1f22e1f4535f893caf92bd81ab7dca97c967e10009780c6e215e1b9ff6f4832450e06d4bec28da61c6ab667b0b7f9565f4b1afff256a6
-
Filesize
2KB
MD59837297721d158d9c76526e2bf5123f3
SHA1e41673d1c8efa954a1d4ecc19b3252991a3918d3
SHA256ac78b7bd8168f6044a4a0d50bbe9e0d696d87d807cf3e0e52bbbd9fbeac6b785
SHA5128a401c448ca77d3f480e60df4b4ddd2b0aa6b4ee7a5361321c5fc65680a9579d0eabb071ef955c8b3e878cbbef9d2cea755b1b9b46880992f4931d7f811b9580
-
Filesize
870B
MD5881a96b628f272d4b280237375e38756
SHA124724e6cc12e4d28651709cbe51b20f6cf597784
SHA256f9e936283d150fe61700b764ced114b4e8d2a3d70f03d6191629f15be3bebd6d
SHA5128aacd39f2bf328409b6be71214edcea61ae443a889f72ec35536a251acec1e8a1327a4f777545324ee02b850b4c72ddc0033735014330e4bbe9268eaed15bc88
-
Filesize
870B
MD522bf91b1711ecb45ff77efd7748ca203
SHA152df2ec5541ce700fd4e8b6e53f980fe8492d08c
SHA256cf75aa78f4339ae4bf007ef0a30fffb8afba38d70160dade90a14698b7d50cc0
SHA51241800a283365d3c02db522db16fabb4dc640ad23943261448c76a5f15989de8ac5f7a9a88b2b422aaa630137c34f605a5c0b1769329dcbf2d9b6d0b29265e7f7
-
Filesize
536B
MD53d63c3b0c4940848a3609009e7b98d65
SHA1ab6027a254199a82f8fafae3cd3f5e3266279043
SHA2567afab831463083b880fb20b12e3a06cf6ea840866b46e2067c6827e39733d721
SHA51265466c8c71651024f4a883d469eb2c5e2a6913448c49c0aacbf5597b4ea9849c46f9054846183e2f6e424f12679502d1eddc19196773c02e8f2dbf9f5ee49aa9
-
Filesize
870B
MD51e9233d15ecef0cec31fedbc19b920bb
SHA1d2ec4277a300cb11b26951b7a1513db2d8da8b89
SHA2560440261f30c941b3e0d05ecf20a9b6f6f93c90154593f727614d8d2c6b21ce90
SHA512af19f1b7295aa530bc8cd47122ecefaa9495e5a26e13cab707ae8b68b76d43fc7c23ad7ea6cf8053853359632be1f379214cd4c6c9caff3d023670eb93a3328f
-
Filesize
870B
MD51ec7a20dc65eb74db2ef9f2edf5bf007
SHA169901ebd2156ab1c59d3e109cab33cbbca322c01
SHA2566ee3dd9e4dc02b87592bd9eb38d1b8cadd437cc888820565ac4308f4961de68d
SHA5121cbeb571edc05a2c0db04c516afeadd924039e380a3faff4067d03a203e6f27a9c4da26d08e51d66de25f4b001c0ff5675af1d5721191552f809ed3ac63cfa06
-
Filesize
5KB
MD5731e7969cd1d30675930822c773339b9
SHA16e5ef73cb9e1309cb5efbd8a8e9fbcf2b97d6fec
SHA256d1dd7b59f16407951475ce59ebcac36452f600116dce13f78b75409c5eccf9e8
SHA512d8b8d6971fb715fe3e5e33fa369fa6850c298fd218e66eaf576d2263f04690ff0c1d91850dd587574c4bbc169751fd764422305644b6932e27f75466f54496ed
-
Filesize
6KB
MD538d2d3cd92f290d748a5ebe6401c005d
SHA12c2b31574d866bd800f98176d29f1a57354a44d6
SHA256f9aef6b837e26b28abf59cfea9fe0ad50fe225be2e813fd5204abbaba84ec5d4
SHA51257f9c33d44ac4658c67802f8fc0a009751521cb9df85db854d6ede1922d5f27a4af601beef1fbc159c82b82750743577dd1fb617d430c65d62c4f1bb7f6feaae
-
Filesize
6KB
MD533e978956f2c650418208059118f3625
SHA15bd8781098e3b8919b78656b99276fc8151cabfa
SHA2562df588d3c395bf3e471ce9aa5f93dd7216686a07938854eb2e318abe18d5edc1
SHA51215255786ed6133020d15b8c7010be829bb6bf017ede1e2511635a8b1a13f86081de803dec948b0b2904aa032267a62ec16730348751061e0620ad6285feffb17
-
Filesize
114KB
MD5afd31fc80382a238ec895b7372de27b1
SHA1dcc43fcc10f681229b9dfabca76b5ae8d2a291dc
SHA25643d1381e4d962fdc956b070ca0fcdbdd2929b14bd05526e771225d5fa3ce0b40
SHA51259796bd644ff629776e5becf20765cd518b3edcbcb01523463cb5d74c5f3558d53a4973548188d213777a27935de0f1da904bbc4988f050aecb8c45670dd924d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd