Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 05:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ec2-52-37-229-113.us-west-2.compute.amazonaws.com/x/d?c=38600633&l=1c9ff335-de40-4036-88ba-07cd4d8c76ec&r=57baed96-1f78-4e3c-be47-eb9fa37e6d93
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://ec2-52-37-229-113.us-west-2.compute.amazonaws.com/x/d?c=38600633&l=1c9ff335-de40-4036-88ba-07cd4d8c76ec&r=57baed96-1f78-4e3c-be47-eb9fa37e6d93
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://ec2-52-37-229-113.us-west-2.compute.amazonaws.com/x/d?c=38600633&l=1c9ff335-de40-4036-88ba-07cd4d8c76ec&r=57baed96-1f78-4e3c-be47-eb9fa37e6d93
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133500304679156239" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4932 chrome.exe 4932 chrome.exe 3052 chrome.exe 3052 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4932 wrote to memory of 848 4932 chrome.exe 87 PID 4932 wrote to memory of 848 4932 chrome.exe 87 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 2116 4932 chrome.exe 90 PID 4932 wrote to memory of 4980 4932 chrome.exe 91 PID 4932 wrote to memory of 4980 4932 chrome.exe 91 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92 PID 4932 wrote to memory of 2092 4932 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ec2-52-37-229-113.us-west-2.compute.amazonaws.com/x/d?c=38600633&l=1c9ff335-de40-4036-88ba-07cd4d8c76ec&r=57baed96-1f78-4e3c-be47-eb9fa37e6d931⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf7749758,0x7ffbf7749768,0x7ffbf77497782⤵PID:848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1908,i,16947909076674790636,5913815778762256931,131072 /prefetch:22⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1908,i,16947909076674790636,5913815778762256931,131072 /prefetch:82⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1908,i,16947909076674790636,5913815778762256931,131072 /prefetch:82⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1908,i,16947909076674790636,5913815778762256931,131072 /prefetch:12⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1908,i,16947909076674790636,5913815778762256931,131072 /prefetch:12⤵PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5028 --field-trial-handle=1908,i,16947909076674790636,5913815778762256931,131072 /prefetch:12⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5044 --field-trial-handle=1908,i,16947909076674790636,5913815778762256931,131072 /prefetch:12⤵PID:3288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 --field-trial-handle=1908,i,16947909076674790636,5913815778762256931,131072 /prefetch:82⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1908,i,16947909076674790636,5913815778762256931,131072 /prefetch:82⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2488 --field-trial-handle=1908,i,16947909076674790636,5913815778762256931,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3052
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD565d54da0d433277fb754e8c42ec44788
SHA17eaa2e5ebdfd799817dfab12ebb153804245c4e6
SHA256729d2ee7ae40a78f8b38a553cd394fb2860ae295a47cf336e46a3c650741d761
SHA512705cde219bf6eb9d2e19a67c2bb7604df42e22d152b3f314668423cf6575b0607d3ada5d5cb542b5be357c3e0bed242200e528b91e1a9a4282b275418f4a8f92
-
Filesize
5KB
MD56a4360761da1f108094cff2729d4a0f8
SHA10a7abe0900a77b3624fa932e0924c9e55cbd1ed7
SHA256693ad4a7e5db8644b143840a38e44c2f15ec585fd6feae56e630feec4257a956
SHA512dae5cfe6dc72faf4f05e0bee487d2f16aa07949a3d077194aede49408ce200e1365a8c5b2d47625d469a7fa9a46faaeaaa715a5b1d90ffca413c65b192a74e6d
-
Filesize
5KB
MD546348d7e7fdb68cc9fee82778cc8ef7d
SHA1133847383d5f76136f6e6261a2d59b24a5167430
SHA256e5ceb0c5de15b6ea5412ef87a7325cf619a5ca38c13302681fe8f8b8dc7f2d54
SHA5125cf6f5e0f0731b75a3a4b22380e268822299009feb6d5098586c4d5c8e1064c548ff5b44936e393e2fb1eabdca591d493d330864f41d47b13dff0ddcc333997c
-
Filesize
5KB
MD5be95d2df6e75125d9a35a3278cbcd045
SHA1009cffc231807299de5c3797425f03dd8327c072
SHA25601a11f76527f10eb0dde054223e2154e542496f6b843fc793bb88dad09bd1c89
SHA51222def31e54a606b76e2e7ec078d1924f4b65914028601b172db598494e867ab8add47c76b7bf598a9c23f7c98c9c0266dbaa0c775668d9e3c7db3f926de58630
-
Filesize
114KB
MD5ca65c92f69956c470a097be9d68a6790
SHA1c9f212ca52f9e15cec174c941f2a0108db72d40a
SHA25608fa2616a7bd39ce69d7ca798200ad505f683b0125a2afb352467dc97fc1e69e
SHA512eedd505a5e7039173658e4ba05ef443e3c147625b83bf2e36ea898b89a5906159760542b837e95978f8746e1be5ee9078deb19a4490cba2d6b3f3cae00e74878
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd