Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20231220-en -
resource tags
arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system -
submitted
18-01-2024 06:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://sigma-api.region-invest63.ru/public/dist/UpdateInfoEditor.txt
Resource
win10-20231220-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
http://sigma-api.region-invest63.ru/public/dist/UpdateInfoEditor.txt
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133500346327715275" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 32 chrome.exe 32 chrome.exe 2080 chrome.exe 2080 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 32 chrome.exe 32 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe Token: SeShutdownPrivilege 32 chrome.exe Token: SeCreatePagefilePrivilege 32 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe 32 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 32 wrote to memory of 208 32 chrome.exe 74 PID 32 wrote to memory of 208 32 chrome.exe 74 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1500 32 chrome.exe 76 PID 32 wrote to memory of 1604 32 chrome.exe 78 PID 32 wrote to memory of 1604 32 chrome.exe 78 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77 PID 32 wrote to memory of 2152 32 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sigma-api.region-invest63.ru/public/dist/UpdateInfoEditor.txt1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe1efe9758,0x7ffe1efe9768,0x7ffe1efe97782⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1812,i,16605970257707402721,17673745870258954471,131072 /prefetch:22⤵PID:1500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2060 --field-trial-handle=1812,i,16605970257707402721,17673745870258954471,131072 /prefetch:82⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1812,i,16605970257707402721,17673745870258954471,131072 /prefetch:82⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2644 --field-trial-handle=1812,i,16605970257707402721,17673745870258954471,131072 /prefetch:12⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2636 --field-trial-handle=1812,i,16605970257707402721,17673745870258954471,131072 /prefetch:12⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=1812,i,16605970257707402721,17673745870258954471,131072 /prefetch:82⤵PID:688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1812,i,16605970257707402721,17673745870258954471,131072 /prefetch:82⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 --field-trial-handle=1812,i,16605970257707402721,17673745870258954471,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2080
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f3866331109c1f2a415f1f28ec97c761
SHA15e2cfb53eb55461147430dc4b158990f623b79a6
SHA25662059583dac8699d0a36f13768ffba8b6acf0b3ffdc9222a5eebe41e83d4f925
SHA512c9321d8f635bda1a7b734e1accd6f89c067ebbe159799bcd6df3837b61a40a5b4d83c1f78fce03835057b515b372da398552b0b2e6e77c0ee7757f29f88df045
-
Filesize
6KB
MD52d6c5c9bf18b93564da17cee2d23950b
SHA14c768c8740a43020068cc5786c1fd2a191d8d447
SHA256467ab2237a24c5f446cd388da9bd977f79c8f7501bdf91da0dcc86166bfdf899
SHA5123dab8e3943181f5cc095834adc798a7a99cf438f7a047534066d236d45d872778989c02d21314262d0cfc6094e43c9b513733f65669a9bb48ebbc3cac4f7c265
-
Filesize
114KB
MD500835bf15c047a2ab58c9ba2e552ade3
SHA1749dd72669d2ca8ecdb02db59306047ac73f8bde
SHA2567db3ab7b95d511ff9721f4c1efc6105ea64ead6f4a0dcacd3d3c45e1d951c070
SHA512a0240f13c24d9e8970c60b57ac6488091568e21fdbeaa2b58227b7db4a762b51a2d6c7a5ff365444338c52c77cbd87371977d1184d508d8e1341848e2ac14a5e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd