Analysis
-
max time kernel
599s -
max time network
487s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 18:40
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://pvl2s29cvuj3d3oc.snh0i.i-iryreaq.na217.bnc.salesforce.com
Resource
win7-20231215-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral2
Sample
http://pvl2s29cvuj3d3oc.snh0i.i-iryreaq.na217.bnc.salesforce.com
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
http://pvl2s29cvuj3d3oc.snh0i.i-iryreaq.na217.bnc.salesforce.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133501632230234184" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1252 chrome.exe 1252 chrome.exe 556 chrome.exe 556 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeCreatePagefilePrivilege 1252 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 4880 1252 chrome.exe 62 PID 1252 wrote to memory of 4880 1252 chrome.exe 62 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 4092 1252 chrome.exe 90 PID 1252 wrote to memory of 5092 1252 chrome.exe 92 PID 1252 wrote to memory of 5092 1252 chrome.exe 92 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91 PID 1252 wrote to memory of 3800 1252 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pvl2s29cvuj3d3oc.snh0i.i-iryreaq.na217.bnc.salesforce.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86ef39758,0x7ff86ef39768,0x7ff86ef397782⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:22⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:82⤵PID:3800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:82⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:12⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:12⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4156 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:12⤵PID:3112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4760 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:12⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:82⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:82⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5012 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:12⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2256 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:12⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4088 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:12⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2880 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4844 --field-trial-handle=1848,i,6470492790217539718,1494106058462765763,131072 /prefetch:12⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:336
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:1560
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵PID:2044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5da880c3800801b37c09ccf7b84afcd38
SHA1b7fc6be19f3803ee0f85782039f6e130177feb87
SHA256919b6a91b67e9a878c643f1b88ac32d24d4528208980778688e27dc99afd20d7
SHA5127a239260220d3387f874261dd2df9ec98aa48afc95fd2e204044c14c578af25ab39c1e20d10ef68e019e9e60737d70800216ac1a82c3ed3c391fe2299735ea52
-
Filesize
6KB
MD5bebb293128a90d137057f2c16ee75cec
SHA19b976567436106f2c3a0aeb596223e8d22b2e76d
SHA25648a86c2bd105a6a189dc8489711cb1eef9e751d5692d2c8e322d9f66f0ba0e6c
SHA512222acf815a7af148bdac9eeac721d3a1e557860f1d946a19d95929e5c72898b9f8a5996528136d889fb9e02771f6e180bfc3e8116802ebcfd3125f0f16e44aa8
-
Filesize
6KB
MD5aa8e637c215406b9d7df37f907843ad5
SHA1e402c403a5c192f4937e12c9fb9fb7c93120aeff
SHA2569f2dfb6a74334deaaeae4b60c6563355d08692327aed2f68c67357010895e607
SHA51222b9f6c46e0cb5a0b7b978cccbffaae176e9daf08189cadd28dfe7a680b8d66b0bd40a58fc48618160d43bdcfc3c8c9c5c21cd2c3ec86898e676b5e79d46a661
-
Filesize
114KB
MD5f878f0c9c65caffab57aefdae71c1a37
SHA15b408f549921bf34893a1c207149c709fe65fa7f
SHA2560addc7892ed39d031f1d3344222153d5c6af4422d63e47460683e0d42becd687
SHA512d902e8f0817694f79399cd862ccecce9ed010b2e5950cafc56b2963db6cf6132fa32274a4e2bbd9269fad086188113a0339023eb852db8bef0f734e8fe59b5f4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd