Analysis
-
max time kernel
601s -
max time network
491s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2024 03:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://simtinstitute.org/wp-content/uploads/2024/01/set.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://simtinstitute.org/wp-content/uploads/2024/01/set.html
Resource
win10v2004-20231215-en
General
-
Target
http://simtinstitute.org/wp-content/uploads/2024/01/set.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133500215596241165" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 2776 chrome.exe 2776 chrome.exe 1468 chrome.exe 1468 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeCreatePagefilePrivilege 2776 chrome.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
Processes:
chrome.exepid process 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2776 wrote to memory of 2152 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2152 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 5076 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 4936 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 4936 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 1060 2776 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://simtinstitute.org/wp-content/uploads/2024/01/set.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe18509758,0x7ffe18509768,0x7ffe185097782⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:82⤵PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:22⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:82⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:12⤵PID:3012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:12⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4604 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:12⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:82⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2996 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:82⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:82⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2548 --field-trial-handle=1944,i,14051360684068365143,12873926903345001144,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1468
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51f9dd9c3dc9302ac1b1ccfaff44ebcfc
SHA1f3ac71cc5d7e02b0c95898fa31bf5f0c6bf2866f
SHA256e12dfe24c4fbc9797f99de50cc1abc6ae82b3c355a62dbd76eeacc15864da5cc
SHA5120ff771130aad32cee76378be438ff445698e4d5c8b52ad001d50a1b21b6865e245465c689090d6c071037d6074866eb54808504fa4ce8d20379b0e34e58c76d6
-
Filesize
1009B
MD55df1f6adbfa5dbf4c20d7e4bf1ab60ab
SHA107f269c736e5c0abb82a0527e09c5c7c14c17031
SHA256e99a358444ec54ba7fb1dc1212e6728dd6128676f11e34b763138a6eb9473f79
SHA5125d51fdfb95b36f6d359ea8c8d3edd7d91ba0c876e95d7471cb086097a57a4b994b1bf07c1cb49cc063a209aef9077cff8cf0b15ec6e52c4da8d863014ee624ad
-
Filesize
705B
MD5f86f08ab5e94a48c573d88ed4a757392
SHA1357a2a936a64a23668f5acd33a9c3cc7a17c26ef
SHA2560ead861f0267c6f3592d4dd13ea75527601adeca3b9535b0ded6840dc18b295f
SHA5121b9a36025eaee7c1740fefabb6476be485ea4e0de21482048044894c975bad50ad3f51179959113d079cc09fd7f001227e0d76aca610b2abeba1073acd94fd2c
-
Filesize
6KB
MD52bc5824adf3661676dc890394c2e72b0
SHA126d5b565de5eda2bfa7c57700423d90097c5405c
SHA2563373644fe6ace12e769a14f406cd009f0305f5f68461ab02d3be14d52e9bb671
SHA512757e1e79cbec62314a353d15ac21af486eaa3d457bd12b57e62cfc98d55a451b51604c8426350c38f986baf36501967abb956488cf3b3c0ddc20bebd8caaffa3
-
Filesize
114KB
MD556eac22069b70882198df4a32fb472f0
SHA12cf3d0f0c70cb18e7457527100c26d99e873da62
SHA256fdfa246c058d5f944efb2ef41e4a94a750c9e578c12998983d6d70e34ae098f7
SHA5122beb0e335c5214ebc9c82609ebd2c2c881e2aabc56e55db35d2e34193abb916e61679269276c4edb599d53e78c87656bba5d5e5d4a4d997f5d2b3716dae407ca
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
2.1MB
MD5d417484674d484761d1c45e4ffea735e
SHA1d4afb397751a815ab9622cbe607ee3fb1ed0d4d6
SHA256f46ac581f22cc597480f20b3615fa164722338004846eb446f05de8db62a0321
SHA51280c7ec748971581afa2177efa46cdca4c6ace0ed76fe94b97e7570c10d88e28e2ee1d2f8fe0c5c1988177b950d94f6182d941538c802cf2c43ca8986b78c1ac3
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e