Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
25/01/2024, 17:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://projcertkart.com/mailwizz/index.php/campaigns/yp6516nv3zeb0/track-url/rf142a00wt80c/1f3c8846b8ddfbe168f950af4f3d425660d12933
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
General
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506773356387547" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe 4800 chrome.exe 4800 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 1244 4580 chrome.exe 61 PID 4580 wrote to memory of 1244 4580 chrome.exe 61 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 1308 4580 chrome.exe 86 PID 4580 wrote to memory of 2212 4580 chrome.exe 88 PID 4580 wrote to memory of 2212 4580 chrome.exe 88 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87 PID 4580 wrote to memory of 1792 4580 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://projcertkart.com/mailwizz/index.php/campaigns/yp6516nv3zeb0/track-url/rf142a00wt80c/1f3c8846b8ddfbe168f950af4f3d425660d129331⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87d269758,0x7ff87d269768,0x7ff87d2697782⤵PID:1244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1888,i,13507161492956013640,9570956970179556507,131072 /prefetch:22⤵PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1888,i,13507161492956013640,9570956970179556507,131072 /prefetch:82⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1888,i,13507161492956013640,9570956970179556507,131072 /prefetch:82⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1888,i,13507161492956013640,9570956970179556507,131072 /prefetch:12⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1888,i,13507161492956013640,9570956970179556507,131072 /prefetch:12⤵PID:512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1888,i,13507161492956013640,9570956970179556507,131072 /prefetch:82⤵PID:1388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1888,i,13507161492956013640,9570956970179556507,131072 /prefetch:82⤵PID:2712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 --field-trial-handle=1888,i,13507161492956013640,9570956970179556507,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 240B
- SHA256 69562c8b09c51dd345c6b7e62151f191de4610d307f9b253cda5caec53624c43
- MD5 cd5e02c321e480d95c02a031a593cc93
- SHA1 08c3570a3a0b2ade126f1f0054b31935677d6d0d
- SHA512 16bb478f18744174c4e60169f82bad050fa3133a96106ba7fd380c30279292c6ce5c01fca1be881c36060c8e4b0364955d88030ad2979c9dd24940b1779c89be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 d7b5de5221b250156e932df3141fccd012bb8a762a10248f47d1be0ed8c0e981
- MD5 2234137c0eb6736127752c5111da564c
- SHA1 049d9bc2de8cd38e3f61ece962e2a4e1e2c6a35c
- SHA512 d3b5fc2dab9a45c663bf0033261f6cff28b84e56a1a92dd6d3670fdb8212fecf5127ff4034c1a99307ddd65367610c1d262265e8e5203b7c35449255f641b2d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 092e13bf3f4ab713038e2c156f47380b6113db52e2ccbd54ded9cabb322c88d6
- MD5 44dfd617d3616fde86b611178f98b1ea
- SHA1 455cef3cf50529427d6403073eee0b02cecff963
- SHA512 6204bb01163a8b58d06a75cb1f1126fba4fa1d683eecac067bee9e9f6a82ad9cd0261f7eead15353596d2a43b82707b4961da7ac52f47bc8e9fea80cc2675fb8
- SSDEEP 96:FAWjXPR1UAKI/Sh8iZRy7Di+6Msmdeqskx1aOgtugjVhYtjEsXt0/cg2Vup:FVjfRyAwh8syy+FrskxYotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 114KB
- SHA256 1fcefb73c03bb9fb73ec5de30729c366474bba8bfaeff92f8a978affa34b94a8
- MD5 b7082d14d877e6c99443d45486df4b26
- SHA1 f82380972e8628e7a3998a97def5fb61a92ba763
- SHA512 99bf5958ca4105c066c1c27fdac39250767ffa3b02074d1bfea7120e8b3d84a4c2df6ce69ca01d13b5e8c914c6a91a985e511c5a7f33444538396829353383e5
- SSDEEP 3072:D5BbH2rDu/htQDoxVulJSKNfyST9gf+wbE6DA3XqKeIP5bv1Q4SgC:fHbJtQDGVG1fyE4+VqiQfgC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512