Analysis
-
max time kernel
1800s -
max time network
1685s -
platform
windows11-21h2_x64 -
resource
win11-20231222-en -
resource tags
arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/02/2024, 16:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/EraFNOrg
Resource
win11-20231222-en
General
-
Target
https://github.com/EraFNOrg
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133515395590090850" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1164 chrome.exe 1164 chrome.exe 4400 chrome.exe 4400 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1164 chrome.exe 1164 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1164 wrote to memory of 3428 1164 chrome.exe 16 PID 1164 wrote to memory of 3428 1164 chrome.exe 16 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 4416 1164 chrome.exe 36 PID 1164 wrote to memory of 3136 1164 chrome.exe 35 PID 1164 wrote to memory of 3136 1164 chrome.exe 35 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34 PID 1164 wrote to memory of 3996 1164 chrome.exe 34
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff6b799758,0x7fff6b799768,0x7fff6b7997781⤵PID:3428
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/EraFNOrg1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1808,i,15038866270968128374,2684896661157999762,131072 /prefetch:12⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1808,i,15038866270968128374,2684896661157999762,131072 /prefetch:12⤵PID:3600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1808,i,15038866270968128374,2684896661157999762,131072 /prefetch:82⤵PID:3996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1808,i,15038866270968128374,2684896661157999762,131072 /prefetch:82⤵PID:3136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1808,i,15038866270968128374,2684896661157999762,131072 /prefetch:22⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1808,i,15038866270968128374,2684896661157999762,131072 /prefetch:82⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1808,i,15038866270968128374,2684896661157999762,131072 /prefetch:82⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3852 --field-trial-handle=1808,i,15038866270968128374,2684896661157999762,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fa58979367b1e80e952690fb674262dd
SHA1cbcfd0cc5f71ceec69ea57d287e4f36825cb9c47
SHA256e3d38d155fcb239df4a89f0ede6516c2d704e4fe8fc770c2665f6efcba2d500b
SHA51250934b9e21082956d8bfae8dd02bd98e54ade8d448bc4c893b699c92ca6643103b9fef890763c243d85c304ffacef54e83d8383a9001a66469d28cb0cfabd10b
-
Filesize
1KB
MD5a002ccc62180cf37f1eeec5d9af75c65
SHA15d1600a89a241fe77d1e3115e174af4016489205
SHA2569234532795664db3165986909f2fc6716f337248c89678a043130a4734311a86
SHA5125673c4508125e1ef59b89fa9526ded722d6030660f538c9b4d4541e4e4819bc6c1eea2e8bcf7798013752f4d9d5a15c2978c33a658390222f8e1e9008f92178e
-
Filesize
1KB
MD5377d9cc9c39baeff56554ed2d5f6efc1
SHA1d9f99a3f3224c38aa399dc683e5824ce3094f89e
SHA256ebb05d160b3794cf2fa682b4514caf66176fb84e36d643d752fae167bf8cf6f5
SHA512cb4662b5aae32982450846c4eecbb48b18f2533d5490638a0bc14fabb06ddae395f41a71acf0b6f7a044ba4b74fcd2a0c28a9eb94e559505ba2d57229e4aeeac
-
Filesize
6KB
MD535560fbe3450f77deec63ed6cf4949dc
SHA165e49663a8d0124478b4bbd887d892cf30edaf87
SHA25657666c7b657a2c206b300aa9ee88b51dff485438a3276b88f07bb0147a00988e
SHA512e4079854c981cfacf7d0e3ddbb8a6c20158907ad6fff5c6db6f43db978df59be8a66e7b69ce0a87078c84f07c30cba5122d4cd83e763514f023191011ec761dd
-
Filesize
114KB
MD5fb0dbeb46e0f7a4ebc716f2020659ee3
SHA13bcec41697893b4d2f09e3193007592337d5f3e9
SHA25619e22b9370d1922230176d23a6b88d5734d2d21ae36eaffe910b77ee0e39fec9
SHA5124b5f751b0657fcddfe43f00002b69912b11ed2c2b3497c1ff6586e6f1cf743dc6e07086ff09d04b82bfbd41e353b21efe4e62c1c4df23a0afc4f3c681bdc2a75
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd