Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
25/01/2024, 15:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ariel-bit.co.il/long/?RmluYW5jZUBjaGVzdG51dG51cnNlcnkuY28udWs=
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
General
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506707243738788" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 948 chrome.exe 948 chrome.exe 2240 chrome.exe 2240 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 948 wrote to memory of 4408 948 chrome.exe 80 PID 948 wrote to memory of 4408 948 chrome.exe 80 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 2728 948 chrome.exe 89 PID 948 wrote to memory of 4584 948 chrome.exe 91 PID 948 wrote to memory of 4584 948 chrome.exe 91 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90 PID 948 wrote to memory of 3276 948 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ariel-bit.co.il/long/?RmluYW5jZUBjaGVzdG51dG51cnNlcnkuY28udWs=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff52959758,0x7fff52959768,0x7fff529597782⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:22⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:82⤵PID:3276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:82⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:12⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:12⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4640 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:12⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3080 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:12⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3964 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:12⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:82⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:82⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 --field-trial-handle=1708,i,17910053046929092517,2104648528354987718,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 696B
- SHA256 edd003923fabafbdff39ff7b68a0137a348fc3760fa2b27ea105e23ee4dcc488
- MD5 9ead0257db0a36ec2140cdd2abdfe6ae
- SHA1 aa3ff4faf56df54fdea1712de7f859c0b5d864bd
- SHA512 534825460852ff84e46f301d7d22e15e23d1973f7e56d27d7db1276450da2064f7d3692e26f11f406d6a3097ee9c647d25ecd3816f875d56f4811e3281e3a47a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 760698c4c53f5dcb759c3e6c8a73e2fba8a4da1de08d7cdc5e877caa005e6f87
- MD5 f141af53180f9165de4c247aae295ec0
- SHA1 edc0999b29252df1c870617d45c3c9aba7788a17
- SHA512 6408b967a44caa63998654332f0a9fce0af70ee6f35a73efb6963d3c68c1486fb384728671726075b5a4eefcabb386fd20e1c54c37fef8646c88c41f002ecb36
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 3f1de6f808cbc7c18cef9bdc0e9cf4a7ea8fdee6ad012412cc4fd33ba15fef3b
- MD5 67e3ad933bcfb676b10cda7d80de915c
- SHA1 072415361b43a4b6d113b4c2432125eb458a9504
- SHA512 fbed917f0652863ea7fa10bc9dc0d756035acfe0f111b16029aaa36b9db95d04c05bba0dc2548815e759a05503cd2cf83f88da38ceac97a82ee5a1201f10c9c5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 e7e64bbec7ada032a0bcef28f348a2cbb2c52a9b22bd6bb320f770118aaee54a
- MD5 6d74a506e211f0238980c5cf12e56bc5
- SHA1 43c5a8fea5fed99afb200ae65828b0868403c2ad
- SHA512 f392104f0fdc98507f38b8bc8f3f68bbbb68d26336f0cf6901c739b58a9004d8b497e27401cf4ae24fdc95f976994991395245b0f099ab032fe9306640a5e11b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 9c38fdfff2a48058c8a3dce5a28f729d238f8ee896b892894dec915b846b70fd
- MD5 f5b21cfcd83f5c650029b7cd432c5895
- SHA1 4f5d2e2450e3c02c41e99271ba44df4099ab814d
- SHA512 a92667429880f002bf5f7d41c8bbaeaec6be9c99dfdf2587eb279ad5814e64eab9c34ea6e6c2443cbe3b48716af8932302508e1fd03869f4b0f1771e2a45c843
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 9656f078757eca111d5305cbaadfa17b871a50a547cf5fdd91285b164c69a4fc
- MD5 8842d17af8ca5f86205740f3593fdbd7
- SHA1 44d0acf776c0feb164a5945685e14b6babd3d3c4
- SHA512 320a1f3111137034d9aca8402c6b8ac74b37d199f8c8bc1df8b0d9b0086ddd91ad075b7426695b20e5ee11e0231c25bbff275d6f9afbf81b9bfcafacd214a4a5
- SSDEEP 96:CiFn6yFHjXiKFKKICFr8iZRy7Di+6MqRgmdeZckG31ZKOrb5S1/wjVhYtjEsXt0P:CsjUG8syy+FqDkIYqotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 114KB
- SHA256 69b5eeaa5c7572af19ed85fa8d533c080ccff4fb97ecd6e44713bec84c8166f0
- MD5 700d72065c7eb644908fa1ae0d26b66a
- SHA1 693e95f6f0893b7191ffd40f84bcc035f512c37f
- SHA512 f71a60dd8f1217ffebeda1b15d696c4d309adb6deacddfba9318feafc95c9adca2757dafe4a40fccfd0a96146f4ef7fa7dfcf35d3a3254fbe7d4c68a302fe2bd
- SSDEEP 3072:Sujl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCZ:DB+70xBmboJnf9/ToL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512