Analysis
-
max time kernel
41s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2024 14:08
Static task
static1
Behavioral task
behavioral1
Sample
edit.js
Resource
win10v2004-20231222-en
General
-
Target
edit.js
-
Size
55KB
-
MD5
3d194446ddc35c9a86ef1bd03a0204bb
-
SHA1
0a710f632abde2d02262573da64a62b127ab6ab4
-
SHA256
cfa12de832b2a2d9f4689d04ac6d515629b87b0632e75c9c88400a92c0c1944b
-
SHA512
b1231b266ce9ee7efe329c381931883c522144d2395a769ed2f60b9ebb083fb238b96de99282a452766802a738931fecacbbcc1dfbac842bb5333b19b63de1ea
-
SSDEEP
768:cc9WWXD1OichQPLpsDq5ORoS2SNMEDm8N6HF/FGNNKxugk39AZ1pFpVl/EVIfnA:P9WWXBOxSPSW8N6fGNNKEgkNy3TfA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133528253756282426" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5564 chrome.exe 5564 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe Token: SeShutdownPrivilege 5564 chrome.exe Token: SeCreatePagefilePrivilege 5564 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe 5564 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5564 wrote to memory of 3088 5564 chrome.exe 95 PID 5564 wrote to memory of 3088 5564 chrome.exe 95 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 3580 5564 chrome.exe 97 PID 5564 wrote to memory of 5832 5564 chrome.exe 99 PID 5564 wrote to memory of 5832 5564 chrome.exe 99 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98 PID 5564 wrote to memory of 4108 5564 chrome.exe 98
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\edit.js1⤵PID:2656
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe7df19758,0x7ffe7df19768,0x7ffe7df197782⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:22⤵PID:3580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:82⤵PID:4108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:82⤵PID:5832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:12⤵PID:6040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:12⤵PID:5188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3784 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:12⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:82⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5144 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:82⤵PID:5200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:82⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:32
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
371B
MD5551cb1653c7640ea9748932353bfe961
SHA13238c9916cb29f83790afa5de29636a9d2b8874a
SHA2564eb05831534c4d782d68370edd5bdf99f8d52ca58680f9160571dbe152219f0a
SHA512e2641d4bee436cb2409426fa88794237e881ecf05f4015ebeed49b48aea72e86496602026f61adc888eb401c13e6f7f78469ec5aa50939dd405f9c91c8e19070
-
Filesize
6KB
MD596c41a86d81a8fa96f0202c6a275d971
SHA14b48cda08cb7421266aa6c2328102bd88888e158
SHA256dd28df275a19eb98dae4593db97cd54a291242a1fe061239e3322549f248cd7f
SHA5123d4a9d3e80680890dd3f7885d3670db2a08abb0c703eb76ae0806d7f89d40079d7b8a95f51eaa04b00db56f2fbcc0961150b5fe9e98463fb57da2fb3004633fb
-
Filesize
240KB
MD5f2fded2a28996b78e03b0660251b45a8
SHA1986e980f29e635921059fca80d548faea57441ad
SHA2561f926950800ec2edccddccf4dbd6585c75f1f0adda4afcadfa29e334a818cb64
SHA512382aa83c89332d3c80655550a774d2f35b392ae5becd4c12c4d7487b432ebaf0ce6308d95e00993232fd25153663dc54a55576c6b7325bc918ee83e57aaae105
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd