Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 09:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://assets.artificial.io/mailing/artificial-full.png
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://assets.artificial.io/mailing/artificial-full.png
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133522919220241017" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1504 chrome.exe 1504 chrome.exe 2576 chrome.exe 2576 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1504 chrome.exe 1504 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe Token: SeShutdownPrivilege 1504 chrome.exe Token: SeCreatePagefilePrivilege 1504 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe 1504 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1504 wrote to memory of 3408 1504 chrome.exe 84 PID 1504 wrote to memory of 3408 1504 chrome.exe 84 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 3640 1504 chrome.exe 86 PID 1504 wrote to memory of 2604 1504 chrome.exe 87 PID 1504 wrote to memory of 2604 1504 chrome.exe 87 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88 PID 1504 wrote to memory of 4824 1504 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://assets.artificial.io/mailing/artificial-full.png1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3bff9758,0x7ffe3bff9768,0x7ffe3bff97782⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1880,i,15571395230041214412,12060825355402509823,131072 /prefetch:22⤵PID:3640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1880,i,15571395230041214412,12060825355402509823,131072 /prefetch:82⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1880,i,15571395230041214412,12060825355402509823,131072 /prefetch:82⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1880,i,15571395230041214412,12060825355402509823,131072 /prefetch:12⤵PID:228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1880,i,15571395230041214412,12060825355402509823,131072 /prefetch:12⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=1880,i,15571395230041214412,12060825355402509823,131072 /prefetch:82⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1880,i,15571395230041214412,12060825355402509823,131072 /prefetch:82⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=972 --field-trial-handle=1880,i,15571395230041214412,12060825355402509823,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
902B
MD552e1366c28a759b9012197f0149f998b
SHA157288bc3d26a3f765f395471c47110a9d347ff66
SHA256eae40ff5bc0c8e8c005a7a7e2f50bf7974a35b868873abb81c63767df935f378
SHA5127df32ca933e2d4343fd411509c472841e206a89fbf856d06b170c1172dcbe42329e84cd10110f00c3c29bd34c16877e64e5ff5614b97ce590ad6a6681fedc488
-
Filesize
6KB
MD52dffa4514d02a4819ff98d6cdf3fdb64
SHA123575476ebd76d5356de6f7725e44e6c964ab6de
SHA25605ed4b09bf8fb407ec8c6c8d79bf8d7633c7012638df2a64a154dbeca3d87096
SHA5124ddc70c0b47501d4f7a02420ccf7d18485e43458fb498e5d7ca3f7e676087916b3f233577537078ce5a3d66e0168597a3cc56f8067bfeaed7782db1bf6519c2c
-
Filesize
114KB
MD590192e90d00fa7bd45d8226bdab9fc43
SHA1449e2a8f74e0e7c679a0dad2deeda3ab0f5d03cf
SHA2564a3cb1895f0c8fffae44618102907ecc3808bc43f586f3a2c0ae27fd84ae9b30
SHA512eea564d65e8d8d8b81400674d143438aba7c0b3153072ff7545fa00df76862ceb38d2bcc642008886fa74b2ad2d75a4bcdb6748fbd29b0f82766646cb7313cd9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd