Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 06:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://172.232.189.7/ait/microsoftdecidedtoupdateentireprocessfromtheserviceofmsofficetoinbuildtechnologytoimplementtheprocess.doc
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://172.232.189.7/ait/microsoftdecidedtoupdateentireprocessfromtheserviceofmsofficetoinbuildtechnologytoimplementtheprocess.doc
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133509817966828198" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 956 chrome.exe 956 chrome.exe 680 chrome.exe 680 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe Token: SeShutdownPrivilege 956 chrome.exe Token: SeCreatePagefilePrivilege 956 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe 956 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 956 wrote to memory of 644 956 chrome.exe 85 PID 956 wrote to memory of 644 956 chrome.exe 85 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 2016 956 chrome.exe 87 PID 956 wrote to memory of 4820 956 chrome.exe 88 PID 956 wrote to memory of 4820 956 chrome.exe 88 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90 PID 956 wrote to memory of 4896 956 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://172.232.189.7/ait/microsoftdecidedtoupdateentireprocessfromtheserviceofmsofficetoinbuildtechnologytoimplementtheprocess.doc1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb23a79758,0x7ffb23a79768,0x7ffb23a797782⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:22⤵PID:2016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:82⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2800 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:12⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:82⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2808 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:12⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:82⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:82⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=6136 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:12⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3356 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:12⤵PID:1508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=6036 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:12⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4160 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:12⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2960 --field-trial-handle=1868,i,14637628705546865121,4365230836024691318,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:680
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5315b878-6334-44c3-b0bb-31fc0b1d1c66.tmp
Filesize6KB
MD5d9de0d6f2ff73c4ecc610eeb1c7830c5
SHA126d807c5b1187aff78cc3c1a6536b5d9b853672c
SHA2565f468f5462e757acb6dccce5d02d7397806ec9fd70e2287318659af0a7d5d711
SHA5124fb84d8ea2f8e0f9ecf457de8454175f2b98a77e0af587167a61323fac2a898c02093fd84573c6aad16a38a42585c85d258ec44a11ca4cb98890c18d354583b8
-
Filesize
1019B
MD501b91c12bf706ce30a8246e79fe3a877
SHA1f33ae023aad2e7fea9bd864369289b94cdf06672
SHA256e7aa6506957f7f52b614b2953479d494c0b35076783b54ac4f4e870b751088d5
SHA512b50e32858d8df936503fe408d9f43387069e8cc45ac39e27659d79f495023b37a5831682bd40fef01811fb5ce54a7c10f8805616e213b9f2feab8da1c26c4c39
-
Filesize
823B
MD563393bd8307a8b2362eb11c22fb78e1e
SHA1a1cde8608a725b8f56579a6de1cfda3d1e345244
SHA2561cb00d92726a7638285d7bb8c49e34266d42230af2119998d8b148628e3538a6
SHA51261ee9127b0762d1324e5c7acc0b9ebd95af63e5f9f428be787edf1108fe7a118559a1fc08036c0d48a825656d5e1126a79614da94084a75362b3adb508bc5a52
-
Filesize
6KB
MD57758276be1d468cc384db008111f37e9
SHA16d33bf70bc8efee8734a04c36b530003d176b098
SHA256179ec2fd68aa219f768fadcf8614eb0518b71879b8a9a8a85073cd5e4da38170
SHA5124d834126b2426acb14dc102820da3c73032891bf3849b48a33c34af89d3a374bfd62ced84bcf737e5982a381ba2ba2f8869d728e14bfdb245f69ab9f5cb5895a
-
Filesize
114KB
MD5118d2a194a3f49a2387335b4b3fdeeff
SHA191771ce4a73d34591adc4f72b68582cda06feeac
SHA256fb933c1155cc47139abfe8da1f811e4ec57ba40802ffacc626bc5e0a2362d65f
SHA512c2d0ff75f9c3a72d52ad51225f5a3647eab3a814b657a7d2563f75202c7958bd537a67ed889a1b8e40613a30e7b31e85fe04a86bc204c563e16e90540f3dab83
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd