Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 00:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://jestinquire.com
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://jestinquire.com
Resource
win10v2004-20231215-en
General
-
Target
http://jestinquire.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133513931172110217" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 3896 chrome.exe 3896 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4148 wrote to memory of 3628 4148 chrome.exe 84 PID 4148 wrote to memory of 3628 4148 chrome.exe 84 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2104 4148 chrome.exe 86 PID 4148 wrote to memory of 2568 4148 chrome.exe 87 PID 4148 wrote to memory of 2568 4148 chrome.exe 87 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90 PID 4148 wrote to memory of 3832 4148 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://jestinquire.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda0bb9758,0x7ffda0bb9768,0x7ffda0bb97782⤵PID:3628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:22⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:82⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2824 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:12⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2816 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:12⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:82⤵PID:3832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4676 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:12⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:82⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:82⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:82⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:82⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2820 --field-trial-handle=1896,i,15985679689850085133,10332327663807298000,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3896
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD5c6f4364792d4f92162ab02988a7f5a17
SHA1780946c26ea554dd1e38206b523f1a93ad964a5b
SHA2569cc2fab7eaae061a62dd5775ad5ec06a29d47ca66fd4b0ea7932f76b90b56f5c
SHA51270b2db910dcd326e200e8b5a4193f9d6bc7276b7f219d8265cd48d7c4ad8ac97c53906d458835eeee4df5b60cae140dabd3bb1b5ff3333727149380cc703fc2d
-
Filesize
1KB
MD55bc77495300a0aafa3a99b156c436836
SHA157ead2c2aacb93e72234def4c2e50a276d4597ee
SHA256b99fc41be429109bf78aef1ccb69f7a6e1fbd9de391650f5547ee74b2f3e3699
SHA5129946a436c70dbd29a20e998b8780490a46ecd55071192ac71ac6416e5d5b31302e787f060036f271ff7f4296ee1bfac88cce142f23dc6b623fc6ddb66da5340b
-
Filesize
369B
MD513d3bebd1109bedc2f6502ccc0848294
SHA15ca3b53b83e02786683fafaf051a6b87cf075fd3
SHA25624f855bea6e6120539ae8dd99ec2b019ba7dce1e0af8616bfc3171c223b6dad8
SHA5126c9617edd9f7cf6d6c94979cb546cf8ce7bda1a3b0fc2b09cd8f0d00c79a42d16b25365dca1354a46f18044fd97a299e752ed35eee71cbfed1ca2992e7ec36d7
-
Filesize
6KB
MD593d3ee75d27f87667c49ffcf1dc19846
SHA1a05ace07afda4f6e582f4a3d69e9cc3f9cd201f3
SHA2562734b9f21b87f555e3234a1fb86df29750af913018c2d77e5b75382579c808cb
SHA51239b5981de1c4fc6bcc62b75f89b040aff7a7a4efb666d4e2cbbd8359e352435964b932754b430f455d14bdbfa9b33770311418e008e8bcd541aad70aed0f693d
-
Filesize
115KB
MD5d5ba9a8e214a6a6c4feae6708bee2475
SHA1b43f521ddb3363da61b8fee8fb8019a80e8ae3b5
SHA256f5d848759a0675f0df663d25abac8f423d83bbee686363fea41ebf77a0aa9535
SHA512596d94f53c284040c48a474a00cb24b457058ebdc2ebab7e4c9925e7701f08bd2aee6ce98878b60adbc7e5ceda3aa3096605d9900e0a489a997a11dede8f5689
-
Filesize
115KB
MD56012ce31b58d7efa9b4ac09728d21410
SHA16a16a9e95726990fe3c8dbca7ea964add55a2b78
SHA2568a41ec371fba35135e6d98572800eac58881444fc0bcc6b9cf23e8c5798af4dd
SHA512e097c506b7bda22cdf51e8f9c02c80ef04199118c0c87d218919617bd5c58aaf38f2a43c348b000f7b167f2ad5887ec48becf883f9f60d03dd58357d74a0f7e1
-
Filesize
116KB
MD538e0a2d08145547ab0d3c6292ed41ef1
SHA1b497c22b3887495a014908a25f6b13ae533c3d28
SHA256bb267849869659b94f7ff5b25e39b1d98c80b7043ac0c4fbd7dfa3935ff99673
SHA512da3c173211ddabd840d780a5587f03ae4af829f8e0bd26273624a06231c0bb92172d5e5083acb8ce7dea0a304339b10c680e5725711f5c80263ad3587f527d7c
-
Filesize
135KB
MD5f34abc83ab85fc6537ae067e2d75bc6b
SHA1593998a658e38025e1f15b200faab6706669f3cf
SHA256f42d3324633eff87ca712c7f679ffc2d85d66b1e127e43e92b695cdcf642ed5f
SHA5124845e0a8470ba2ff9de473bb45886741e079ed6c3453323266fcdbdf7369495148ba7783e85ed5d768c5b94a7bef58bc67a99c8345e097877da1849f6fceea81
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd