Analysis
-
max time kernel
68s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
23/01/2024, 10:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fentholdings.i%2dsight.com%2fcase%2ff167e3a5%2da974%2d457d%2dbc80%2d24e191754fd8&umid=ad985048-7519-4b4a-88c8-06a0a72bb539&auth=65a620fa4b6e2edf0405a6ed61dc7465231096cd-527e229a0969bc726b1c22644c8c95accde4bf92
Resource
win10-20231215-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fentholdings.i%2dsight.com%2fcase%2ff167e3a5%2da974%2d457d%2dbc80%2d24e191754fd8&umid=ad985048-7519-4b4a-88c8-06a0a72bb539&auth=65a620fa4b6e2edf0405a6ed61dc7465231096cd-527e229a0969bc726b1c22644c8c95accde4bf92
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133504787585191305" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4756 chrome.exe 4756 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe Token: SeShutdownPrivilege 4756 chrome.exe Token: SeCreatePagefilePrivilege 4756 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe 4756 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4756 wrote to memory of 168 4756 chrome.exe 39 PID 4756 wrote to memory of 168 4756 chrome.exe 39 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 4376 4756 chrome.exe 79 PID 4756 wrote to memory of 1892 4756 chrome.exe 78 PID 4756 wrote to memory of 1892 4756 chrome.exe 78 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75 PID 4756 wrote to memory of 8 4756 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fentholdings.i%2dsight.com%2fcase%2ff167e3a5%2da974%2d457d%2dbc80%2d24e191754fd8&umid=ad985048-7519-4b4a-88c8-06a0a72bb539&auth=65a620fa4b6e2edf0405a6ed61dc7465231096cd-527e229a0969bc726b1c22644c8c95accde4bf921⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff84db19758,0x7ff84db19768,0x7ff84db197782⤵PID:168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1760,i,4412984157203859436,5972231534168412205,131072 /prefetch:82⤵PID:8
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1760,i,4412984157203859436,5972231534168412205,131072 /prefetch:12⤵PID:1560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1760,i,4412984157203859436,5972231534168412205,131072 /prefetch:12⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=1760,i,4412984157203859436,5972231534168412205,131072 /prefetch:82⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1760,i,4412984157203859436,5972231534168412205,131072 /prefetch:22⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4492 --field-trial-handle=1760,i,4412984157203859436,5972231534168412205,131072 /prefetch:12⤵PID:1080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1760,i,4412984157203859436,5972231534168412205,131072 /prefetch:82⤵PID:1504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1760,i,4412984157203859436,5972231534168412205,131072 /prefetch:82⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD531754aa740ab7d2755376618552b8fc7
SHA13a9d500ff5abd7f6f3ca119f377f4152d3c0001b
SHA256ca4c08c2f9b13e7dca1b18f3ec8db416964c605d58ead5bdc637db366e51f2fb
SHA5122e963965db38f76a06e8ae5335491ebf8ea0928f6c3bec1239c069a96c5359c0b10bca16617024f8f4705bef9d3255840214d3834df5feaee859e70d4f83eea1
-
Filesize
6KB
MD575188989d60c11a900be3f6948e59cb6
SHA1cac2e9571d2e83c12cb65a2fe77e09dacdd58d69
SHA25668a15f5b5a9a6078a1a9d2ca4337b9aad5faa3c4f0b3fa0f761e4f5a909f3169
SHA51255fe6f761c3fa8a6da763aeeb01c99cf39ab5a8dd60da1a799a984e647fa5a6e195135daf24413766d61abe589709dd9335456fd98f94a2bf9d0198ff542a0a8
-
Filesize
114KB
MD51d448165323070089d2e9c9243a9289b
SHA10a1c4a62827048d78cb9ee9726fb0167fe689e4a
SHA256ce84d726da0d306119e38a005c1e5c9b55108bcf70f128af02c2f43023198622
SHA512baf20a41552ddfcb9119091b2343806375f35cfe1945a20b7b33a213a854cde32c8f828a146b10c84f83fb2c6590f91b6006e8855da462a2a793ad031f04503d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd