Analysis
-
max time kernel
60s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23-01-2024 10:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://track.chanret.com/trackclick.asp?ThreadKey=fjtm42bb1&Email=am9obi5yYWR6aW5za2lAaW52ZXNjby5jb20=&url=aHR0cHM6Ly9zMy5hbWF6b25hd3MuY29tL2lzaGVsbHlzYWxlcy85RVNSSFRKVEJGRFNTR0hULzgvOS5odG1s
Resource
win7-20231215-en
windows7-x64
6 signatures
60 seconds
Behavioral task
behavioral2
Sample
http://track.chanret.com/trackclick.asp?ThreadKey=fjtm42bb1&Email=am9obi5yYWR6aW5za2lAaW52ZXNjby5jb20=&url=aHR0cHM6Ly9zMy5hbWF6b25hd3MuY29tL2lzaGVsbHlzYWxlcy85RVNSSFRKVEJGRFNTR0hULzgvOS5odG1s
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
60 seconds
General
-
Target
http://track.chanret.com/trackclick.asp?ThreadKey=fjtm42bb1&Email=am9obi5yYWR6aW5za2lAaW52ZXNjby5jb20=&url=aHR0cHM6Ly9zMy5hbWF6b25hd3MuY29tL2lzaGVsbHlzYWxlcy85RVNSSFRKVEJGRFNTR0hULzgvOS5odG1s
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133504783737575807" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4008 chrome.exe 4008 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4008 chrome.exe 4008 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4008 wrote to memory of 3924 4008 chrome.exe 84 PID 4008 wrote to memory of 3924 4008 chrome.exe 84 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 4424 4008 chrome.exe 88 PID 4008 wrote to memory of 3316 4008 chrome.exe 89 PID 4008 wrote to memory of 3316 4008 chrome.exe 89 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90 PID 4008 wrote to memory of 1696 4008 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://track.chanret.com/trackclick.asp?ThreadKey=fjtm42bb1&Email=am9obi5yYWR6aW5za2lAaW52ZXNjby5jb20=&url=aHR0cHM6Ly9zMy5hbWF6b25hd3MuY29tL2lzaGVsbHlzYWxlcy85RVNSSFRKVEJGRFNTR0hULzgvOS5odG1s1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0e699758,0x7ffb0e699768,0x7ffb0e6997782⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1868,i,3679030808475701787,5195828926313556452,131072 /prefetch:22⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1868,i,3679030808475701787,5195828926313556452,131072 /prefetch:82⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1868,i,3679030808475701787,5195828926313556452,131072 /prefetch:82⤵PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1868,i,3679030808475701787,5195828926313556452,131072 /prefetch:12⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1868,i,3679030808475701787,5195828926313556452,131072 /prefetch:12⤵PID:112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4340 --field-trial-handle=1868,i,3679030808475701787,5195828926313556452,131072 /prefetch:82⤵PID:780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4408 --field-trial-handle=1868,i,3679030808475701787,5195828926313556452,131072 /prefetch:82⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54e1a47c85a28dbb580c92f13a5c096d7
SHA12d0420a767348503a774ad325499a9d01951e945
SHA25630027670114cd5e003864d7a7991b685c0da98d4b8ee1397c620a0454c1f2cdb
SHA512cacbbfe1dec09457ec60387bb3066f2a854d7930a73bf7ea0b30c2351a0eadaa7710391d0f2f31ec2eda3a48ac6bbd9284b598fbcf3f01711d61163d36475da1
-
Filesize
5KB
MD5f36504445dda46163dcb988ec8c8068b
SHA1faf6fe464ff09440c4f8d7e1d0a8ac9fe6687e08
SHA25631b88315f65f876e19dd5d3f821bbc0e5cc078d2875a380e663f8e4d76e62fd6
SHA512f4d6560a1e105a6961612964ef8728c573290e50759008ff573e2fbb33e3bfda9c83a7a90795836868fba457d6310d448eab63589ba9630b853f9c67cfe248d2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fb334606-93b5-4053-b94e-8921d0f8e8ae.tmp
Filesize6KB
MD56080a3fb7181ace6481d6b49d1017834
SHA12d1dd62133d6c57a79478e8fc1e096613fbf5149
SHA2565fab83875538946e09e5db49e7e5203f261ad3f679fb0b9c8c38ddf15b49eec1
SHA5123a1ff55ad77d503a900d192e1d9a9a117419751f141c8aeb991be38932731009f4c33de676360b261669f504014b44d9ce5fa8515b9cba30765a138e770bc71d
-
Filesize
114KB
MD578b91856e75472c144f9dd3eda828d26
SHA15bc070bd8e03eea098e4df121892d2cf218999fe
SHA256e3dad4fb0ed508e99aab914460e2bf173c74d644e91606ae453163310dfddc67
SHA512519f46cfe23f6b67f3001e563b5766df8edc873963f2d040e44bda2c77c23c1faf8343bef38d219ef5db202aca831aa5377625f4657ec2f8d60ad8c5f879a5d2
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd