Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 03:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bmrefs.com/wp-includes/Requests/Response/-/-/-/AU.php
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://bmrefs.com/wp-includes/Requests/Response/-/-/-/AU.php
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
https://bmrefs.com/wp-includes/Requests/Response/-/-/-/AU.php
Resource
macos-20231201-en
macos-10.15-amd64
0 signatures
150 seconds
General
-
Target
https://bmrefs.com/wp-includes/Requests/Response/-/-/-/AU.php
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506266619629112" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1620 chrome.exe 1620 chrome.exe 3812 chrome.exe 3812 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1620 chrome.exe 1620 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 4112 1620 chrome.exe 19 PID 1620 wrote to memory of 4112 1620 chrome.exe 19 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 1088 1620 chrome.exe 91 PID 1620 wrote to memory of 544 1620 chrome.exe 92 PID 1620 wrote to memory of 544 1620 chrome.exe 92 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95 PID 1620 wrote to memory of 2500 1620 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bmrefs.com/wp-includes/Requests/Response/-/-/-/AU.php1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf4a89758,0x7ffaf4a89768,0x7ffaf4a897782⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1804,i,10093730929848148914,13787782077378831334,131072 /prefetch:22⤵PID:1088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1804,i,10093730929848148914,13787782077378831334,131072 /prefetch:82⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=1804,i,10093730929848148914,13787782077378831334,131072 /prefetch:12⤵PID:428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1804,i,10093730929848148914,13787782077378831334,131072 /prefetch:12⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1804,i,10093730929848148914,13787782077378831334,131072 /prefetch:82⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1804,i,10093730929848148914,13787782077378831334,131072 /prefetch:82⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1804,i,10093730929848148914,13787782077378831334,131072 /prefetch:82⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 --field-trial-handle=1804,i,10093730929848148914,13787782077378831334,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3812
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
824B
MD549916aec80b195f9261073f3fd0409c9
SHA13e1c507c67dbf260814abac4f58857f956940957
SHA256e072d3eef552e04a7c6934687e000d8363a1c25d67fa788c268e4a99e0c512d0
SHA512cd97ca8d7e2d7d8650ca74f12ea229a37f148ea274bd083735f57a73a2d3481dbea0f77e28a27dad7b8dcee6ba4103e48e1d5ced0a20302468c6860125a53095
-
Filesize
6KB
MD5bee768f85aa550d268db48aca54450b8
SHA16fefe8cd3721c149b457ea9d8367df8ca127a479
SHA2563fe59612b6f453ee818af68b13bd783fda59e379077208e8c80edaa8c7cad8ef
SHA5125cc6884c4ec3de6012ded53e4d7794e0e1636e10cfdf61d7fb0479eedaf17923d93aa9b46a7cfb710ca1a2ad26341ca1bcc2d1d665f2568f3a510094c841219b
-
Filesize
114KB
MD5d821181d99cc20881b143d13deaa3f73
SHA14b97afcba9b9a43cbccb5caf80da0939b70bc53d
SHA256b5d70054a05bf609da451453cf6d9f0474140dd4757d07e613613c8a37a37e4d
SHA5121213abe390423c081a09006405bd31a462aef46b77046395f47865ecfa74d2381741e16a156625f78094dce7477ed39a4feaab4d7b3ca908a7bc027a13d897fa