Analysis
-
max time kernel
411s -
max time network
400s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-01-2024 17:10
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506763238711792" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 464 chrome.exe 464 chrome.exe 1424 chrome.exe 1424 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 464 chrome.exe 464 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 464 wrote to memory of 4884 464 chrome.exe chrome.exe PID 464 wrote to memory of 4884 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 4692 464 chrome.exe chrome.exe PID 464 wrote to memory of 1396 464 chrome.exe chrome.exe PID 464 wrote to memory of 1396 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe PID 464 wrote to memory of 4776 464 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.zoominfo.com/pic/mitutoyo-america/252643231⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff988569758,0x7ff988569768,0x7ff9885697782⤵PID:4884
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1804,i,1457790882482659241,4667276396305938083,131072 /prefetch:22⤵PID:4692
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1804,i,1457790882482659241,4667276396305938083,131072 /prefetch:82⤵PID:1396
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 --field-trial-handle=1804,i,1457790882482659241,4667276396305938083,131072 /prefetch:82⤵PID:4776
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1804,i,1457790882482659241,4667276396305938083,131072 /prefetch:12⤵PID:3296
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1804,i,1457790882482659241,4667276396305938083,131072 /prefetch:12⤵PID:1620
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1804,i,1457790882482659241,4667276396305938083,131072 /prefetch:82⤵PID:3128
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1804,i,1457790882482659241,4667276396305938083,131072 /prefetch:82⤵PID:908
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4492 --field-trial-handle=1804,i,1457790882482659241,4667276396305938083,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1424
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
144B
MD592ae56aa5bba3649e9a222899075fc4c
SHA1bfc17acfdf0ad63f62d12f75c8c7fb0345b42d2f
SHA256808bf05663993ee7a96a33b624d5189c647681dfb3fda3256b7a9b10f8b872a4
SHA512859ad238a8b3bb9a79ba3b5fbf3a27ef68833cd61463b4295199cbc24d5caccb544556c7069803b41c41c9f84eddd08bfe2ae70ec4d807e9d46561276c16bdaa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5970a2d6127ce8ccde9f1d3cefb806e32
SHA10fe509a5a267e83bebfbc5424624af7600d4ec8f
SHA2563e84a0c04faf75cbb84886b3ce3f74aea633f95e4d60af7128a9c3d70efad07b
SHA512ee74960bb3faab98d0f4b1b7f0dc77f57964d0b1ca3fbb09b293cc0c661ce647aefa55d55c5021214e32cf49183e84f9fbf6044f4f197b03935642222cf1313c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD50e06b5195426f80348cf630360aec926
SHA158a3f0b4538bec97c86f20e0ac125a1730690d41
SHA2564348d2c19f0b2aaffc9214b79e4a5cac9090f9fdee84a3b320a54366665d2410
SHA512b91e2a295935857c5eee838a3506c9768e1dab58bfa464aa914d4d33e4d587fdce15406c1add3c1ca438733a9aaa970d400bd7feb5bda280bd7bd3e233f95f72
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
539B
MD59f7a1a7ad1e9ba098268f78036b2924c
SHA16952f02ef685164e6462f7bf5ddfbf4dc3394f3d
SHA256d603b2c4f3522301a84588f75a587e728f59b3d7dbcaeb17b7415c1f4e7b084e
SHA512793b41d5be71fb70aaae9a816bd2c79c31aa6a701d55c4004eefe49f0145059c0ada074b462372169e7bac62a4993b003829c987beb00147cd2d23c49901b272
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5c9aceac0c674bbb8a4e58744b0664b59
SHA1f81bb97abcb54dc28763d54eaa8347b40614a208
SHA256d3b6a25ce0708cc2533d45c0f2a5bb8c4b4ce227c1e5d58ff66e11447f7773bd
SHA512538eeff5b94ac414b6788a20433a122664b00f0979d753d8d9cdc6508343e8dda4825d6f9e5111bb0cd3d34e4eee49e152c039d5f087df4e62751adb4425b243
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
114KB
MD5e5b2074070ea16dab436019a2dc41ed1
SHA1dc8197d7059c2f386b13eaf532b2056d890ec2b3
SHA2569b0a21215c51a518f9a71886841d7599fbe2838a415016a7f76445050f4713c5
SHA512eb03882b7a5a6d68e091c2c690eb266ad7eaffd53882d68013e29950e051c3df6ba2b09369df132295431bee9cbb60b796b9aad1066778901cbdc73b7d3477ad
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_464_AKKMOPCJYATZEGIGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e