Analysis
-
max time kernel
1798s -
max time network
1690s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04-02-2024 16:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://isexychat.com
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
http://isexychat.com
Resource
win11-20231215-en
General
-
Target
http://isexychat.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133515396008780382" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 212 chrome.exe 212 chrome.exe 4740 chrome.exe 4740 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 212 wrote to memory of 700 212 chrome.exe 84 PID 212 wrote to memory of 700 212 chrome.exe 84 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 1664 212 chrome.exe 86 PID 212 wrote to memory of 2600 212 chrome.exe 88 PID 212 wrote to memory of 2600 212 chrome.exe 88 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87 PID 212 wrote to memory of 2484 212 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://isexychat.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff837bb9758,0x7ff837bb9768,0x7ff837bb97782⤵PID:700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:22⤵PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:82⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:82⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:12⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:12⤵PID:2772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4632 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:12⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3136 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:12⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3196 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:12⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:82⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:82⤵PID:3480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 --field-trial-handle=1880,i,8799073656088570597,5426322072941868891,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4740
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264B
MD5ea6f5465b7afdd76652dcf1558a857a7
SHA1fbc4bf0dda793c30ba0477677ff5ee52a5fda639
SHA2563eef61608584c396729162f65d95611d95944123acbf83b5206e753e00464f93
SHA5124998eb001a09f8e88af9c71a8892c874942b17d6ec7f1c86e373eb8b82d7e794a26e627a7d6628ca34c3a390edbb4ed355442d55e46e04a822cf6e3b183d2ad4
-
Filesize
3KB
MD57d06fbd9ca3da9b8419baab8bbf1a459
SHA1367dafffc19bbbe8e1cead8f47fe297bb0d96254
SHA256eb3a443041c96679335a4d162fd28ff88de4ffb2d94c412f48b213d419af84d8
SHA512834bda982250b259b8746ea533654881a14e63166706ee7e4f31b5e78f3fc1e5ff0487299c1c00277c88d795a82313d8d61c2214dcd4674dadaf218c94338a5d
-
Filesize
3KB
MD5c1df8081ecbd734120268f68472e54c6
SHA10ab2423c312f79e782b10db32927b3d8553f14a7
SHA2563cc6ea46254d2e92b090ee0c7eeab09b811e1b11c56b7326d5d102a801b0e064
SHA5129ebfcb7c8c5d07237aaac8e0ed6688da0d69cce9b895669fec51933afc8886bda69748cb845e2412d82ebeefe81e5042d42b4b33aea7e509171038d716695acc
-
Filesize
2KB
MD56bc773d8e4d6f77a99503d57521108aa
SHA12caedb76aee0a788fc4540c8ae490696755ef54b
SHA2567f47d64f0d4ed0027df1d76fc92b20d8a50a4ca4abd0b9365fce9a2ac0ad1556
SHA51227bd1a1cfff2d8e0f2c6274daeb6d6b7ff8c7bd55054ff109f1fd469fc3bb83f84b30a513ef4e9cac862e48e9501d3d4032735bf1eb45893ea4d4f5d7b750600
-
Filesize
866B
MD510c1a5913cb507677a13285127719014
SHA1616e17d3053d894eca0be48a443d64602c796a84
SHA256447f68d5772ce672d3ea6ba2c42d4e0f8e6e8ddd1c4f5199c6e64973f2eaa8d6
SHA512ce4e746f9386aaa0e2e436123ecb4f45dfa62af1c0061cf2c1c5eb7c712a884a4559f26dcee6fedf9397c00dafb59a8c966dce4203c0e372dca2987e2ba2d574
-
Filesize
6KB
MD5d0d54666f16480ce206e91e2e4cf2da6
SHA151585f4ab537972b22aa7e0f5faf238452df6c26
SHA256014365358496d1827c1cc45573494da93816a94d4b86797540742e5e494fecdd
SHA51205f9fe40241d51862a4ff0c853851e0de02bee76b576085c05fcb783454601c4978d7f49760bc89990308cc5b754898079b9a875d0b0ed4aa88824fdf6590e80
-
Filesize
6KB
MD51ff6666b3de89d16f020e6e5df429229
SHA14f93903b001c99f9d52dcd7ea386c84568ccea22
SHA25613b16d33d124802010b86d236516044a54c5dc69a0239d042bce59ec11b2b49b
SHA5126033e907144b973007456fc178174eaeb8ff9a4fd6a6b8d49a337da24c1ddec4b8c99b0135d25597c3d5cada57fbf0d2f39e729a90f2e37e11057b79f336b904
-
Filesize
6KB
MD51d6114c786104db69eff3da3aae9a377
SHA1321fa9b1411fdc187db4387598a9e48f210c4f7b
SHA256b764a87deb2a42b940bef37187e8109f6d3038ab8de66cf561afb114f3f1a863
SHA512110aab9dbfb86285f7fd1a47fcc1a3b42e3560dbc14e9ed1b6fa7726e5c045ff0856097eb8bab00fbc56bdbd53d3f27b6eb3c460450087d575c7bd8ce05cb1b1
-
Filesize
114KB
MD591e9ca3f445c93d59fe5c266d1112fd4
SHA11000aaa33d808b33c484123f713ea7ff152b5b50
SHA256d3c0d5e83c6ef3a6b16602bd7e511c946b388f5a1eeb91b539fd41923ae9fe69
SHA51271c2d23a454134f384394007d00eb40a5a793767c4a54f8057acb3fb359add056d23ecb5c91580743a4d92c025d59c52fdc5bf9e8349750dd0b5200cced9a316
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd