Analysis
-
max time kernel
599s -
max time network
591s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
03-02-2024 11:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://jdfsdifjdfisdcslk9sk.blob.core.windows.net/jdfsdifjdfisdcslk9sk/url.html
Resource
win10-20231215-en
windows10-1703-x64
8 signatures
600 seconds
General
-
Target
https://jdfsdifjdfisdcslk9sk.blob.core.windows.net/jdfsdifjdfisdcslk9sk/url.html
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133514325975016501" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 4440 chrome.exe 4440 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 4888 4324 chrome.exe 65 PID 4324 wrote to memory of 4888 4324 chrome.exe 65 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 3032 4324 chrome.exe 80 PID 4324 wrote to memory of 1532 4324 chrome.exe 78 PID 4324 wrote to memory of 1532 4324 chrome.exe 78 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77 PID 4324 wrote to memory of 4940 4324 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://jdfsdifjdfisdcslk9sk.blob.core.windows.net/jdfsdifjdfisdcslk9sk/url.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc460c9758,0x7ffc460c9768,0x7ffc460c97782⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2852 --field-trial-handle=1704,i,12743903320535094309,523199033528233534,131072 /prefetch:12⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2844 --field-trial-handle=1704,i,12743903320535094309,523199033528233534,131072 /prefetch:12⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2052 --field-trial-handle=1704,i,12743903320535094309,523199033528233534,131072 /prefetch:82⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 --field-trial-handle=1704,i,12743903320535094309,523199033528233534,131072 /prefetch:82⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1704,i,12743903320535094309,523199033528233534,131072 /prefetch:22⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1704,i,12743903320535094309,523199033528233534,131072 /prefetch:82⤵PID:4280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 --field-trial-handle=1704,i,12743903320535094309,523199033528233534,131072 /prefetch:82⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1704,i,12743903320535094309,523199033528233534,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4440
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5204a475e4bfcfebbe171da8d37d8de57
SHA1b4345fc88468e35f4d8303d7049c5a1a896af7a6
SHA25666edee22631c4d39a85f8d3dfd12757f97345c730128fdfc6ca7e8e4556e7a12
SHA512dac6042d291e0ca5e404c09e11e43389a6367598f3a0f9d5793b3273a3b8bc3fb7328986c33703c6eb5e0f3a919c7ec0a45b4b95eb1dbdbc3eb600ed08dc2825
-
Filesize
6KB
MD5701a20cf53ff086e050fd0d11a629fa6
SHA1f408e5e40a8511db72dd474d6331dd7862133fb6
SHA256b76a9584a93fa8c07acefaa968258caa370ecf831a6b152327caa1c2e09e8a75
SHA5122bc65809f39cd9a5cb62b006de2f1e4a979459c9769b9b65dd2b75cee63c84c6e0ff3016510d9b41c3c40636f2f6f58ebff7e620d0c5d643c3e57b0cfc530f63
-
Filesize
6KB
MD5bdf79210c4dc2e354993b4520fc83e03
SHA1daa0491f01224b219d9621a71ec1a6c9b69c91ab
SHA256e93d0b05e718fd0835c8538a10644dab7909ab1fc9cd423676105d252d099556
SHA51297c52133094720352ebfe365fea7044602e6283a22bcb741550cbb01a6291fd5bf711eaf9d0287ed94fa852e310235567c7f5095d5a6695db1b239e7eb63ddb0
-
Filesize
114KB
MD543f0733e2466e2f74bc36e874e9f312a
SHA11967534774787ddba1f9e826941e0294890e1654
SHA2567a56ae3264af80b33bf45cdcf8ffa8141d34011b0c12a26de336f72bd5a3c08b
SHA512ce2be945bd2e42ced84975638b7c80a9af0150e0cf39ae9600883b0c6befbff78b95539b9ef3857efee3bc4734274690a59dc7a2360d3c820e9c9e3c318261ad
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd