Analysis
-
max time kernel
68s -
max time network
70s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 17:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pub.marq.com/cd0ed3f5-04cd-4a7d-b908-f88c18e45cd3/
Resource
win7-20231129-en
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506772898330776" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2316 chrome.exe 2316 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 3048 2316 chrome.exe 85 PID 2316 wrote to memory of 3048 2316 chrome.exe 85 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 2236 2316 chrome.exe 88 PID 2316 wrote to memory of 4592 2316 chrome.exe 89 PID 2316 wrote to memory of 4592 2316 chrome.exe 89 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90 PID 2316 wrote to memory of 4528 2316 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pub.marq.com/cd0ed3f5-04cd-4a7d-b908-f88c18e45cd3/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7fff42a69758,0x7fff42a69768,0x7fff42a697782⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1940,i,6230687489415024211,11543732839756035825,131072 /prefetch:22⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1940,i,6230687489415024211,11543732839756035825,131072 /prefetch:82⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1940,i,6230687489415024211,11543732839756035825,131072 /prefetch:82⤵PID:4528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=1940,i,6230687489415024211,11543732839756035825,131072 /prefetch:12⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1940,i,6230687489415024211,11543732839756035825,131072 /prefetch:12⤵PID:1184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1940,i,6230687489415024211,11543732839756035825,131072 /prefetch:82⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1940,i,6230687489415024211,11543732839756035825,131072 /prefetch:82⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3712 --field-trial-handle=1940,i,6230687489415024211,11543732839756035825,131072 /prefetch:12⤵PID:1284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5572 --field-trial-handle=1940,i,6230687489415024211,11543732839756035825,131072 /prefetch:12⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 --field-trial-handle=1940,i,6230687489415024211,11543732839756035825,131072 /prefetch:82⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD5245b14a2d1c7d062d629e63666087cb4
SHA1c757e7221b129a0aaeca3de30e664403ac13625e
SHA256974adbcd1a17ef63538168bd1e2734060ce834cd153c271349be57b3457fb9a7
SHA5122951c5cf6af29e342ba6bef20d0332314870884d9a02279077c69ee421b2d7839e04c161bed348a5dae866a0bde62183a1cc3747da49b18a2656a3a1ab3a38b8
-
Filesize
1KB
MD55d204335857eba16ceebcf165b02b5b5
SHA1a5ee335695c50fb5ce63c6e85e8ddf9ac9b71f46
SHA256a4eeb14ac017cf654ca8a182107c637f3c3bbcde753be94aa9bda8d0cad47d92
SHA5129da2442ff20323e95e1aa333d0095f5f755a696d5c547d5d0ebfa85c4517f3452e70e071b7ef9d43f6c0a9f8643995a14675566d3ffc9e92c5ada2207f68c9ab
-
Filesize
2KB
MD5e65d1d9a5e24f1630e8f78d055d68158
SHA1e7700730c1724b55e31bd7b7cd692c8e944dbf75
SHA2567821d31caa5ab3628d13c89f1f644c9351d6890673d954e2470bb8f9e6f72214
SHA512ffc730b12777416292838fd18bc44b7a7e632a44cf52a9f26e7a765a868d2a9b43f54e51931d45846aec324e67a29d5c41e8bd0a3d66f59c7686995b5415b4d0
-
Filesize
6KB
MD5cbd9ffbff4e22e3926af11693b27601b
SHA1d827f41b5f6d0a3fc8a302a84f98e55b8334ded4
SHA256ef530ab3d7bcb934dce4cec3486188854ebff0dd40a13f5dfcabbee07d0b86b1
SHA512c2489c7a8736c15e7b1ce0925403da5589e929daf3169bc469f40c74fe24360d047d9645ba1ee38ea6f68c5289a64ef77e9a826b10f1bfc0dc258c265955597d
-
Filesize
6KB
MD579f5c7036b443609a5b1eb9ac6225680
SHA1f809befb1ea4ef2366e0f3b2f863303fada396bb
SHA2567d0e652cb479586cc40d5073458158dc61f5030b2a32ea7679a870a8eff40fe3
SHA5126c2d52dfd5c8e1414d137a9780bdf5c4b0a33624ca4fe8918e4bf6ff38a5df3db1712efa1303b2ac32907729aa97a2b70b70935cef85477bb384155abd861d93
-
Filesize
114KB
MD5d0a3067a36c58c0b23bdfbbd6fab251f
SHA188f0f81780aeebfa3041db2fdbd05548ad62ba4b
SHA256e75a481374b8506db1874705076fdd995adab348530e34dfc43d6980029f8711
SHA5124a281353f2b2a9f2bf21fcfe7d27da42d10c418cf43711fe4126cbc2872079d6a9e5d63d06718d861fcadb47f49baca21df417209bbbd389bae04ac36e86637f
-
Filesize
114KB
MD5655d5cef42881ae4c259e50d0303056f
SHA18d873f60535c490911d56335cb64369d4db21369
SHA25645fdc0afed0530918d22f337985c086f1646ce35ab2a90c33bafb9d4caec0a3c
SHA51229f729d32fb993ca9778ff1318d6a7665bdc831cb38378cdab5e858fc633fc535d43c7c2ee8e44d8e4623a5013c879769f9570ed10497d68a8bff144c3181db3
-
Filesize
103KB
MD566211329f5daafcffbbf936b42577cef
SHA1a888bce35e041d19283b8b6fc4a81a3e584842b5
SHA256aae9590a9a67b59d466e2ac0432eeef0cba636bb1f54a7a2f34c83383caf7b02
SHA5122278aed7797ed4e9fb10369f931bcf70f34502c8ed1df833141617ded01a3ed2559bc278d025e3955774f479703dbeb3aab783707eb29b84c880e164408eb4f7
-
Filesize
101KB
MD5e67797d6d914fcb62618122a839b0eb6
SHA1ce8ee8662693fcf0da430679f7263a25904a3619
SHA256510a055dc125b07fb12da5131e7f702ee996f05c8354bb28c4bf13a09269c497
SHA5127d659893a3c1ccf637d5eb26511e0e9c03b4449eb532aa94e14b263189dbc2b2dcc60473994e0d61c7e0caf4a60d8d7747c7516be2a7d3d9c2a602720f67a853
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd