Analysis
-
max time kernel
1799s -
max time network
1794s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2024, 19:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://rublox.site
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://rublox.site
Resource
win10v2004-20231215-en
General
-
Target
http://rublox.site
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133504425260590466" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2700 chrome.exe 2700 chrome.exe 3480 chrome.exe 3480 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe Token: SeShutdownPrivilege 2700 chrome.exe Token: SeCreatePagefilePrivilege 2700 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe 2700 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2700 wrote to memory of 3592 2700 chrome.exe 57 PID 2700 wrote to memory of 3592 2700 chrome.exe 57 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 3516 2700 chrome.exe 95 PID 2700 wrote to memory of 1468 2700 chrome.exe 94 PID 2700 wrote to memory of 1468 2700 chrome.exe 94 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91 PID 2700 wrote to memory of 3852 2700 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rublox.site1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce3969758,0x7ffce3969768,0x7ffce39697782⤵PID:3592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2148 --field-trial-handle=1880,i,6742674074567882391,15150355451082779205,131072 /prefetch:82⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2804 --field-trial-handle=1880,i,6742674074567882391,15150355451082779205,131072 /prefetch:12⤵PID:1220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2796 --field-trial-handle=1880,i,6742674074567882391,15150355451082779205,131072 /prefetch:12⤵PID:2792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1880,i,6742674074567882391,15150355451082779205,131072 /prefetch:82⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1880,i,6742674074567882391,15150355451082779205,131072 /prefetch:22⤵PID:3516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4620 --field-trial-handle=1880,i,6742674074567882391,15150355451082779205,131072 /prefetch:12⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1880,i,6742674074567882391,15150355451082779205,131072 /prefetch:82⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1880,i,6742674074567882391,15150355451082779205,131072 /prefetch:82⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1880,i,6742674074567882391,15150355451082779205,131072 /prefetch:82⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1880,i,6742674074567882391,15150355451082779205,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201KB
MD5c445ab4315d0633d446998c80764cc36
SHA147d3dee9845cc6e29b6771dd6560793b8b93000e
SHA2565635695eeb70b51c449aea7a5bd3c9699c3c28c64498fb7fcb8173aad45d7242
SHA51283a32ffdddf3ee56e89f232c8d05a4b00265895b0e41d13700f90fa389f0bf3f112c291c24c3819751803322b11e2ff866971d835d601672b36818c4e099bff1
-
Filesize
216B
MD52fd6fd106993e82d7e965f1541e9984c
SHA190563c35cc6fa5d97c5fa7d24845f54b083ff140
SHA2566bab9e53a51457bf63d2a0e9b6d4832727033df1fc8cf4d908f9d9e33fc8d7ea
SHA512afdb1d537e5258a014222795375b10e18d281cb220ba0f91cecaeaa25062e5d61343a2be7d52e7b6f69f0191a8121bfe7e7a65c838f9657e2b649fd4fa3682b3
-
Filesize
2KB
MD59a6fcc915e2248e4e53a217412a20047
SHA1c99eb9389dbbd563c6e3c12fabe1091aeb5bb938
SHA25643b0fb3d8967fc9040bc78c618b7a30d6d33458beef13ccabb57ef065587aa96
SHA512df5abe1a261e767a15872defbe56324f1aa31a7c93f442ee06dc6a5fcc179cb69b3f7c92626d976efaaf7596ea4f85ae982b483cec0e73fcacf707480f669f40
-
Filesize
2KB
MD5bdc15f3caf5e78257767a081db5babad
SHA19ed0baab4fdb3b579496ed32fa79646e6bbe08f3
SHA2566ba267334d8947f2c80c7ca934e94548bcae5fba02b3b921edf1de10115ebee6
SHA512bbc33541798b5de00e7c71d4b6738bc7a5f741ef2967b10a025142ea5cc84c02ba1999e3bfc3d211b7055b2ce79d93b88d96067b83327e20873463c31523aef7
-
Filesize
1KB
MD54c441d43ce13cf240024b3cdfbb16e16
SHA10dea946e7f9310119295289623e1038e80ce6168
SHA2569790abeb395ab73a6ac78bebfec65f787b0ce18ce2f0d25d73d7ce320c3189d9
SHA512ce70bac97b643c9d9f3a99ea880fa8507c065abb829686d368e6fed6f91ce2f3aab9a2646b2ba9aca3bcbbe796beab7413e5b3274084ff150b3c3425fb8e1af3
-
Filesize
2KB
MD5edcf3ac63628480e2226738ef21bbeda
SHA133fbd1401ce379e180e9f1c8b03095b25cf74a86
SHA256d43cfc31cb23cfacd4998b311365f97d56cfec6ffbc9b7c9934b9242c8402d74
SHA5126389f4be89ae0fb6b6c90b4ab20aa3ffaed48e807652ba6e81af1fbdf78530b34b7a493e0d3327a1f197ca77a13d62a55da0016e348de754bd43743da60d750b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b695eefa-f2e8-46cf-b581-1a8dc744909b.tmp
Filesize702B
MD57af222450ab3172fb91c1fe7ef8dd14e
SHA1af5797e001bd561e65a445e1d6dc079d20de9aa0
SHA2565fdaed5844d40bcfd06c9f7ca1e5fa4986c28ee9fae20d916e108398168adbc0
SHA512a4e26ef0b035606284848292a70d5a16d58136c0ab5324be0ef75063eace31a974a6ee037128d64f1f0c2ae6fcd983a4e0d8649f041ac19233a5fa2f619e7e7d
-
Filesize
6KB
MD5aef62d0f0753b715f84dea1c3e9286f4
SHA126db5b313ad46d6bbdcf1fb1ee8ade879ea8651c
SHA2566acf9b41e972ca7b80b082e52e4a465040e5d83efbd15bf05d051fef2d50b811
SHA5125072dd145c1cdf1ec69593e7f145ca9fb4c74ca078efa65b5e0008066985b4f493457102162685bdcc54be12e8494f4363234453f28f329d8c497d2ed4bd5cf0
-
Filesize
114KB
MD5fe857cc6d749c2d1c1b8889526340e49
SHA1af077d78fd02069aa47b4622638453850559d7a0
SHA25621cb41440b9427645887d9cdc0286502016f9206b8c35c1e4739238e992bd1c8
SHA51224aaf136da54d1a5f62cdb9dcd3ef22874917e47996de3327bfcf3374ba9beacfbc71a652096897fb8c81355abd63b848a195245f6fe7614b93a3641a74f2c47
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd