Analysis
-
max time kernel
1807s -
max time network
1704s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231215-en
windows7-x64
2 signatures
1800 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
sample.html
-
Size
16KB
-
MD5
3e788681439ba014fc894fbe6b3a5e4a
-
SHA1
3268e92e3e6c521c3803989608e449fad22d85f9
-
SHA256
0baa276512b7fed36cbd00c2dfde307d906b2c28ad8c4efd0ae0f1bbb63ddd28
-
SHA512
570325d7560347aec539fbed0388e16b211659ec7cfcdca11e9765b21b0b0b53aa4203fa5fedf7c30f965c85552ae376aa600cc4c6a32d39c6a8529978cc7b41
-
SSDEEP
192:PNx5Ssv99qXoqTJkNr423Wd32dDKiTlEmQVb8/afETgp9dAQvyeZY7CH93yyN:5Ssl9qYoJkN0v25K+2mXvY9WSyeZY6jN
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133523956851206650" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4524 chrome.exe 4524 chrome.exe 2660 chrome.exe 2660 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4524 chrome.exe 4524 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 984 4524 chrome.exe 81 PID 4524 wrote to memory of 984 4524 chrome.exe 81 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 2612 4524 chrome.exe 85 PID 4524 wrote to memory of 1964 4524 chrome.exe 84 PID 4524 wrote to memory of 1964 4524 chrome.exe 84 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86 PID 4524 wrote to memory of 3168 4524 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff960469758,0x7ff960469768,0x7ff9604697782⤵PID:984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1912 --field-trial-handle=1928,i,9250815323569648989,4158101702313769593,131072 /prefetch:82⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1928,i,9250815323569648989,4158101702313769593,131072 /prefetch:22⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1928,i,9250815323569648989,4158101702313769593,131072 /prefetch:82⤵PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1928,i,9250815323569648989,4158101702313769593,131072 /prefetch:12⤵PID:180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1928,i,9250815323569648989,4158101702313769593,131072 /prefetch:12⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1928,i,9250815323569648989,4158101702313769593,131072 /prefetch:82⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1928,i,9250815323569648989,4158101702313769593,131072 /prefetch:82⤵PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=996 --field-trial-handle=1928,i,9250815323569648989,4158101702313769593,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2660
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
823B
MD50dcf82fecdc66678202375a30e68641e
SHA1113d863c689bd3baf342977b1469ba9d7a52e52a
SHA256a60d0e42a431411ed194d4508a96eed66e6a5e8772a9d97b5e9bac30c2e43dec
SHA512bdb393c27590dfd060e93f1ce3991674992c8b28e132f1a5297b5aa5742da852b36c5d83933195277eeb3bc8b1d614a4a5f68261f4452510216090bd20b07ae4
-
Filesize
6KB
MD591ac817697b6a3aba8a6307a812615c0
SHA11937959ee6cd23ac4d3174f2105acfd01bbee9bb
SHA2565f618b7a57bd4677f951362a15247befe0c809a4c699e02ab5942016e725e0d2
SHA512858ee7782b1ebe5bdf83cb92b727d54449df06875f6377e71891ea66000644e22f0eb80b08e3ebb83d6ba4128d151c3e0923ae9241d3e11596b993547f9f4791
-
Filesize
6KB
MD5a44bbc389c9a3c99807e36729ecb4f85
SHA1e4a641400edfa25ccc7905e4a06b89780f4e47f3
SHA25619de7a77123efda3417cf2cca70a6aeb7d22a18cf20b321053e8f4890e52f1e0
SHA512ae316c973bfae76122900e6df5bf0abf342c58b39ee21df49927136b1b4fa65513e7e01ab0839886a8b8bdc1be20fd882aa60e6d57f3dd98785cd49ce6c56bbf
-
Filesize
114KB
MD5421a8819df2d1a02df0df2210170c946
SHA15c85908b1886042982254716296949db8acbe13f
SHA256df7036be99ba8dd865a5f0ce272607fbfc37ef5106995d54c7a2321343016b36
SHA51258991c8a299a3bfe0f5167d40a900c280ed22795a30630e7285c859fd105747f9e8c0cc453d42da660d4c1248bcc2f543924e01c9c87778683dca62ce4ead793
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd