Analysis
- max time kernel
601s - max time network
491s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
18/01/2024, 03:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://simtinstitute.org/wp-content/uploads/2024/01/set.html
Resource
win7-20231215-en
windows7-x64
16 signatures
600 seconds
Behavioral task
behavioral2
Sample
http://simtinstitute.org/wp-content/uploads/2024/01/set.html
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
600 seconds
General
- Target http://simtinstitute.org/wp-content/uploads/2024/01/set.html
- Sample240118-dtf4qabgam
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133500215596241165" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2776 chrome.exe 2776 chrome.exe 1468 chrome.exe 1468 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe - Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2152 2776 chrome.exe 87 PID 2776 wrote to memory of 2152 2776 chrome.exe 87 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 5076 2776 chrome.exe 91 PID 2776 wrote to memory of 4936 2776 chrome.exe 90 PID 2776 wrote to memory of 4936 2776 chrome.exe 90 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92 PID 2776 wrote to memory of 1060 2776 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://simtinstitute.org/wp-content/uploads/2024/01/set.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe18509758,0x7ffe18509768,0x7ffe185097782⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:82⤵PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:22⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:82⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:12⤵PID:3012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:12⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4604 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:12⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:82⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2996 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:82⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:82⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2548 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1468
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 e12dfe24c4fbc9797f99de50cc1abc6ae82b3c355a62dbd76eeacc15864da5cc
- MD5 1f9dd9c3dc9302ac1b1ccfaff44ebcfc
- SHA1 f3ac71cc5d7e02b0c95898fa31bf5f0c6bf2866f
- SHA512 0ff771130aad32cee76378be438ff445698e4d5c8b52ad001d50a1b21b6865e245465c689090d6c071037d6074866eb54808504fa4ce8d20379b0e34e58c76d6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1009B
- SHA256 e99a358444ec54ba7fb1dc1212e6728dd6128676f11e34b763138a6eb9473f79
- MD5 5df1f6adbfa5dbf4c20d7e4bf1ab60ab
- SHA1 07f269c736e5c0abb82a0527e09c5c7c14c17031
- SHA512 5d51fdfb95b36f6d359ea8c8d3edd7d91ba0c876e95d7471cb086097a57a4b994b1bf07c1cb49cc063a209aef9077cff8cf0b15ec6e52c4da8d863014ee624ad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 705B
- SHA256 0ead861f0267c6f3592d4dd13ea75527601adeca3b9535b0ded6840dc18b295f
- MD5 f86f08ab5e94a48c573d88ed4a757392
- SHA1 357a2a936a64a23668f5acd33a9c3cc7a17c26ef
- SHA512 1b9a36025eaee7c1740fefabb6476be485ea4e0de21482048044894c975bad50ad3f51179959113d079cc09fd7f001227e0d76aca610b2abeba1073acd94fd2c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 3373644fe6ace12e769a14f406cd009f0305f5f68461ab02d3be14d52e9bb671
- MD5 2bc5824adf3661676dc890394c2e72b0
- SHA1 26d5b565de5eda2bfa7c57700423d90097c5405c
- SHA512 757e1e79cbec62314a353d15ac21af486eaa3d457bd12b57e62cfc98d55a451b51604c8426350c38f986baf36501967abb956488cf3b3c0ddc20bebd8caaffa3
- SSDEEP 96:yAw9LXXhXVP1KIoiINN8iZRy7Di+6MsmdejkY1L8OiFi7LjVhYtjEsXt0/cg2Vup:yl9LpV9yr8syy+F6kYVZotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 114KB
- SHA256 fdfa246c058d5f944efb2ef41e4a94a750c9e578c12998983d6d70e34ae098f7
- MD5 56eac22069b70882198df4a32fb472f0
- SHA1 2cf3d0f0c70cb18e7457527100c26d99e873da62
- SHA512 2beb0e335c5214ebc9c82609ebd2c2c881e2aabc56e55db35d2e34193abb916e61679269276c4edb599d53e78c87656bba5d5e5d4a4d997f5d2b3716dae407ca
- SSDEEP 3072:wjl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCf:wB+70xBmboJnf9/Tot
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\INF_Note.zip.crdownload
- Size 2.1MB
- SHA256 f46ac581f22cc597480f20b3615fa164722338004846eb446f05de8db62a0321
- MD5 d417484674d484761d1c45e4ffea735e
- SHA1 d4afb397751a815ab9622cbe607ee3fb1ed0d4d6
- SHA512 80c7ec748971581afa2177efa46cdca4c6ace0ed76fe94b97e7570c10d88e28e2ee1d2f8fe0c5c1988177b950d94f6182d941538c802cf2c43ca8986b78c1ac3
- SSDEEP 49152:SFGnFQ5TrwkKUGTDnv8gLrR77P3kwbrG1bKdRkfmz/oE8rL:SFGnFQV8v8OV0rKrkfmz/oE8X
- MD5 SHA1 SHA512 SSDEEP