Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 18:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ea.newscpt20.de/_la.php?&nid=4962375&sid=292345912&lid=22266159&enc=68747470733a2f2f7777772e6976772e6465&tg=print/epaper/epaper-statistik
Resource
win10v2004-20231215-en
General
-
Target
https://ea.newscpt20.de/_la.php?&nid=4962375&sid=292345912&lid=22266159&enc=68747470733a2f2f7777772e6976772e6465&tg=print/epaper/epaper-statistik
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133522373313602775" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1392 chrome.exe 1392 chrome.exe 3280 chrome.exe 3280 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1392 wrote to memory of 1536 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1536 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2020 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 704 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 704 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 2212 1392 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ea.newscpt20.de/_la.php?&nid=4962375&sid=292345912&lid=22266159&enc=68747470733a2f2f7777772e6976772e6465&tg=print/epaper/epaper-statistik1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb61dc9758,0x7ffb61dc9768,0x7ffb61dc97782⤵PID:1536
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1892,i,3557389445324513554,5927600969869405177,131072 /prefetch:82⤵PID:704
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1892,i,3557389445324513554,5927600969869405177,131072 /prefetch:22⤵PID:2020
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1892,i,3557389445324513554,5927600969869405177,131072 /prefetch:82⤵PID:2212
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1892,i,3557389445324513554,5927600969869405177,131072 /prefetch:12⤵PID:2516
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1892,i,3557389445324513554,5927600969869405177,131072 /prefetch:12⤵PID:4540
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4640 --field-trial-handle=1892,i,3557389445324513554,5927600969869405177,131072 /prefetch:12⤵PID:3596
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1892,i,3557389445324513554,5927600969869405177,131072 /prefetch:82⤵PID:3280
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1892,i,3557389445324513554,5927600969869405177,131072 /prefetch:82⤵PID:2460
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 --field-trial-handle=1892,i,3557389445324513554,5927600969869405177,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3280
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD580ed5693c949684ed116854ca70d3637
SHA1ee03a2265317988afa671edd6c238b7c2f963641
SHA256057e7144135242783b73c0ad6ab596f95095aeb2ed399c0d5bdcbcfce4b92a6f
SHA512c63570bf988f8991afc78ea766d57026a3daf7aa1e559c863d5dcfc4f46fcebfbfb3605d3730c12732a093fae76265b476e5e82e203f8dd237b2b31479ca0b46
-
Filesize
891B
MD587b839f19f9dd202a84a7963dc1e0819
SHA16f6659f9b8c2eb3b2e67ce97e6b497f2e0dceeed
SHA256f6b0145191cd37f950df4ce1bfedece9f503163f7b0b123a8e59a4e3e18e6a59
SHA51255b1a3c68dd7991e654efded11692f69949e33668a30f3f9e746a760cc0473bdccee35149ae608c44a7aa1acbdd167f87f262d7b2a4c0413f4b04ab8737f1d79
-
Filesize
6KB
MD5a2e4c218e0234ffff5fae9d0aaa7f07b
SHA1eef3a39d444feb9bc42e65bfae5a461378b28950
SHA256462b6bfd0454b3241143b81ba205a9f6a0e348f15383b2f9d3d88cffc2ec602f
SHA5127e7d703f81720a22061f6c2d50cb8027a1253cc82c136929f3bad8fe8d87e4a7825bd97c9ae0759a88a8eed95d7d1eac705cb5b75a61c22d76a84fe34bbb5848
-
Filesize
114KB
MD5aa5d8fc696f60e5a1a65a32d66a3bc8f
SHA1249948ac1b1565b3c7c20ba6c5009c4d8d76426b
SHA256a33bb03beb407e328121b70cc848143ee06fa08773a0cab4863cb37eb766c9ab
SHA512b3a68f3fd66285d8e7268b7980284b4243cb4dea3e8e23ff8e8adbc7b9394e83be63a488985661ed6b8fa08ee3a9bf6a60870fe302b01ddea03735248ad8a040
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd