Analysis
-
max time kernel
300s -
max time network
278s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 20:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www2.firmex.com/e/15482/ide2324Global-utm-source-email/ppf82y/1091554912/h/LCGtxmKy-W8yTV7ZCP8bb80fbr92KV2K9CzqXwc65ws__;!!D1sDotPi8BGI9gw!k589ozuOTv5xSF4Fw9YMpgJbVA61l1gp5TF44zXrL-Gv4DFtRpAForQ6CvduQ7ExQFUQX1IOe0M8xFzRVc11oA$
Resource
win10v2004-20231215-en
General
-
Target
http://www2.firmex.com/e/15482/ide2324Global-utm-source-email/ppf82y/1091554912/h/LCGtxmKy-W8yTV7ZCP8bb80fbr92KV2K9CzqXwc65ws__;!!D1sDotPi8BGI9gw!k589ozuOTv5xSF4Fw9YMpgJbVA61l1gp5TF44zXrL-Gv4DFtRpAForQ6CvduQ7ExQFUQX1IOe0M8xFzRVc11oA$
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133522416860530844" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 2256 chrome.exe 2256 chrome.exe 444 chrome.exe 444 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 2256 chrome.exe 2256 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2256 wrote to memory of 116 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 116 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 2504 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 3308 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 3308 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe PID 2256 wrote to memory of 1436 2256 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www2.firmex.com/e/15482/ide2324Global-utm-source-email/ppf82y/1091554912/h/LCGtxmKy-W8yTV7ZCP8bb80fbr92KV2K9CzqXwc65ws__;!!D1sDotPi8BGI9gw!k589ozuOTv5xSF4Fw9YMpgJbVA61l1gp5TF44zXrL-Gv4DFtRpAForQ6CvduQ7ExQFUQX1IOe0M8xFzRVc11oA$1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd81169758,0x7ffd81169768,0x7ffd811697782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2672 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2800 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4584 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
824B
MD5d9f041c7fec8f6a081b13a1ba655352c
SHA1b887900236b7c80b901c9616e3c5f71e06ca65bb
SHA256a41f28a9f8741c7d59a20877f2e32b95bcdc53a2702bb31cf215ee2d758d9f94
SHA51214d07ae7505f106457071bccb62e13ec5b402696eb2276d6aa487a523d75932b2c34880b8d4623a09df2aabd7b29a3beee5e152ccf95e3ab6e6940005bc62148
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5f65dcffac1122ac0fd85c08185f163c2
SHA16b0a92badc3370e5b6134070973e6abd0b5d2934
SHA256185faf6cd96c4f0214937d9a842cbece539678195473f410aa6a9c569e6176ec
SHA512b39fd413afc3aa0f577f41a1b961cf3157af065c11ea3444d2952f0edf3cbd35ebea83f3e8d85a8efd04fa497d7f4eab7e813a5e43a1df0e057aba8f48897f08
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
114KB
MD518618118970d2b56cf6e00e7c7002b71
SHA1c5b2c265153c73b971ab7839b09801fa47a4b399
SHA2568d0e684c189a76e39b34d87b90b7e3da663a05955a7eb12b0a1f862461bd8319
SHA512f0f52438bd659b5167e8570a33e54a2425d3c0926a2b4d45a61c2fd0260ed785accac7822f552dd81dcd701febf4bf2b96a376fcf2e7add311c4ed77dec3cd9d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_2256_EPPXOFQOPRXYVSJTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e