Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240220-en -
resource tags
arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 23:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://vk.com/away.php?to=https://assets-usa.mkt.dynamics.com/a4ab8032-b4bf-ee11-9075-002248282d34/digitalassets/standaloneforms/3a0fce95-03d0-ee11-9078-6045bddc4e11
Resource
win10v2004-20240220-en
General
-
Target
https://vk.com/away.php?to=https://assets-usa.mkt.dynamics.com/a4ab8032-b4bf-ee11-9075-002248282d34/digitalassets/standaloneforms/3a0fce95-03d0-ee11-9078-6045bddc4e11
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1020 chrome.exe 1020 chrome.exe 2960 chrome.exe 2960 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe Token: SeShutdownPrivilege 1020 chrome.exe Token: SeCreatePagefilePrivilege 1020 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe 1020 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1020 wrote to memory of 912 1020 chrome.exe 45 PID 1020 wrote to memory of 912 1020 chrome.exe 45 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 1292 1020 chrome.exe 85 PID 1020 wrote to memory of 3200 1020 chrome.exe 86 PID 1020 wrote to memory of 3200 1020 chrome.exe 86 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87 PID 1020 wrote to memory of 3844 1020 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vk.com/away.php?to=https://assets-usa.mkt.dynamics.com/a4ab8032-b4bf-ee11-9075-002248282d34/digitalassets/standaloneforms/3a0fce95-03d0-ee11-9078-6045bddc4e111⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96aba9758,0x7ff96aba9768,0x7ff96aba97782⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:22⤵PID:1292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:82⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:82⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:12⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:12⤵PID:556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4600 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:12⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:82⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:82⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2692 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:12⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3140 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:12⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3736 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:12⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1692 --field-trial-handle=1836,i,854534895262024653,15824723544773019755,131072 /prefetch:82⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD583fe9d5e6162e38e961eea55f35e501c
SHA1f688f0f9bb016fc4eff396c39373692f1ba4110a
SHA256def23706c523ad9ac1f16977b031e18993f93d0c8853a15305975c13f52f2d72
SHA51240f4c5985f31685d6b3684f832aa979e7f31dd1f904250144e0fb079f251e9c3dbc7d9653e7eb889aabfa10d71d65c03490c297bdd17f92e5565d9941be40371
-
Filesize
1KB
MD5e1860740f0da4ccb41d6cb8cb4cc2cf6
SHA12b980d35fb38868b0dfe4074399b46f3ee145707
SHA256efaca19bbbfb9f256e0ce2bd793d91d29a39035737657151261bf5051f48da58
SHA51234f1943b5868dda979c836d0faafb3d23ead7295a7b20f574ff9b0329a5442b842651ca4a7e19f8edf3126e930e91a3312a36decda62d340777e98c6f0ef1e0e
-
Filesize
875B
MD548c37296adec809f87d7e3a09855a60c
SHA1d1c30493e36c2b505953a3549fd45e9a9cbc077f
SHA2568f56e3055a491ff286b01d9c4ef1bc33ee1c0f7e2ce7586f692ebbd802aaa5ef
SHA512955375616318241632203a3fd234b7ae3cf4e6dd7256ec35a030790815bc679a1499cc600c7f63f42b36f990209501f15f73fe95abdd24e7e37ccf12e1024969
-
Filesize
6KB
MD5861094b35f7de6cb22f076b930f061cc
SHA1c4579562423354cb9ba0c5378af3b3c350d63da9
SHA2565db43f52ab9886c8709afd7da093a11e25ee52895c828dbd3241aaa8ebc48837
SHA512d2730e6e1b32d9e05b974a42b46459bd787e4ac9b3c7dd4620f91d9979abbe8876390add0d53c8bdee8f9d704c025d177f4ca28c9aaed75ed0046ed82bbe5070
-
Filesize
9KB
MD5710302589edae45f32ac043f4b9c4f06
SHA1119015f65fb5e107aef8bd3802b2b3432487c547
SHA256921d8e6af767a3fdf198b137ab6a0fe41c70e59ce8d9010baf6c3ed7e63a62a1
SHA512612785ddb2d2eb23a859506af48db3ec7bcb53e3ca01926cc4fca1c54e4dc92843570ce2b7f2097ad43a7ca14ba16b88adbbfc9bff9e84fa239999771f64f84c
-
Filesize
9KB
MD55b862d38c1920cc03b01b298dcc48ccf
SHA148e62807b02bcc32ed12ee6e843910cf7b125fc3
SHA25644ccdb8e5db74f4823a0354e0855648b40d44ef8fefdde35df65e1a74be66803
SHA512a41c9391e4f1181b2c6d94ca9328944e2ba7c370403b6e80d72f6d4c3079cbaf22a403af1abedef414e0f1f337788fc7648e617e89d88c3ac51bea28a4dcb78c
-
Filesize
130KB
MD5cd09c319aa7a8e5c7dfe941c83d15352
SHA18683043a54b693eb4ed1b65cb452a5182486f49f
SHA256fe861f85b81e120ba9f26ab3247d5ab604b85fcefed757fa3746ef0ef65f13fe
SHA5121a6401c9e718b154570ffe728a03a2da4ffc767e0661db8bc3f54c2df1c95688032aea40b22818d92d141d54ea9731023a2145021a7712c95974ee5f04082144
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd