Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23-01-2024 20:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://files.constantcontact.com/b5a37604301/7fb27b07-6c8f-4eb8-94fa-4e6e104e2ffd.png
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://files.constantcontact.com/b5a37604301/7fb27b07-6c8f-4eb8-94fa-4e6e104e2ffd.png
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://files.constantcontact.com/b5a37604301/7fb27b07-6c8f-4eb8-94fa-4e6e104e2ffd.png
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133505151296995270" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2964 chrome.exe 2964 chrome.exe 1952 chrome.exe 1952 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2964 chrome.exe 2964 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe Token: SeShutdownPrivilege 2964 chrome.exe Token: SeCreatePagefilePrivilege 2964 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe 2964 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 676 2964 chrome.exe 14 PID 2964 wrote to memory of 676 2964 chrome.exe 14 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2848 2964 chrome.exe 34 PID 2964 wrote to memory of 2856 2964 chrome.exe 31 PID 2964 wrote to memory of 2856 2964 chrome.exe 31 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30 PID 2964 wrote to memory of 4656 2964 chrome.exe 30
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86d9f9758,0x7ff86d9f9768,0x7ff86d9f97781⤵PID:676
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://files.constantcontact.com/b5a37604301/7fb27b07-6c8f-4eb8-94fa-4e6e104e2ffd.png1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1796,i,5085451665878330070,11028570506395153133,131072 /prefetch:82⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1796,i,5085451665878330070,11028570506395153133,131072 /prefetch:82⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1796,i,5085451665878330070,11028570506395153133,131072 /prefetch:12⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1796,i,5085451665878330070,11028570506395153133,131072 /prefetch:12⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1796,i,5085451665878330070,11028570506395153133,131072 /prefetch:22⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1796,i,5085451665878330070,11028570506395153133,131072 /prefetch:82⤵PID:1008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1796,i,5085451665878330070,11028570506395153133,131072 /prefetch:82⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3840 --field-trial-handle=1796,i,5085451665878330070,11028570506395153133,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
823B
MD599cdfdc72701e0ae1d65411ec04af9bf
SHA133c81325c63daaa8165e7496087a56e8f6f0551e
SHA25650ea6942dba895538669702a8ece32f5f395daf7824dbe1d47750bb25b8c449a
SHA512a66f50a4a907b6befc5b791eee84f12b139cfdf14c56171fd8d3b06d7ecf492e177863c6066dfa130aa3f92c38e9648c762c12cae44ed13ebd2d7b22e983830c
-
Filesize
1KB
MD59df7ab0f5081aa6911dd85f94e468f37
SHA1c1f236dafb9cbeb28c3082248d556b44fce59bda
SHA25682a4d379aef946a7bb7fc23ba2c036bd6283332de5edfe80862fd445180a0fa3
SHA5126e74835c0bbca5986d17b49abc5f90d857b55dada499d98facc6ffe703197afa677bb13c509c3bc972b7d207151472b9b21852c7f065fd73d73ed50726ee0665
-
Filesize
6KB
MD531c651ee89618fc13499547177f6d487
SHA1133e7182c3c98552d3e6704538e3b976e46b1419
SHA2562613edb6d02795d6fe997ee23ef9b2d11c5a6655fa8c09d7ed7e538a384634e8
SHA512009bc0782b76f33bbccc20717371c27a8649567fe9e22608e0d7b59b94e722d8b0a44606e450078be8b85c9d5845dbdc327e2c36a18413aba7d58bb713e65116
-
Filesize
114KB
MD51343e0bff005aa64e53dd77f66be6c4b
SHA1c9cec72896b411f23763dfdc42fac1cba49b532f
SHA25619bfa94590cd8499fd6393eafb562836fc3f6c05ea671cfb4034568780dac950
SHA51278219a988b74075f038e3fda0e2687bef77e4611c825a448b8e72ee5a1f319cb3bd15a8d53967f2d4ccddf68a9d51f2593be0ec265d45c5581f18285acbb25c9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd