Analysis
-
max time kernel
51s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 04:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133528769703295623" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 948 chrome.exe 948 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 948 chrome.exe 948 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe Token: SeShutdownPrivilege 948 chrome.exe Token: SeCreatePagefilePrivilege 948 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe 948 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 948 wrote to memory of 4988 948 chrome.exe 83 PID 948 wrote to memory of 4988 948 chrome.exe 83 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4584 948 chrome.exe 85 PID 948 wrote to memory of 4552 948 chrome.exe 86 PID 948 wrote to memory of 4552 948 chrome.exe 86 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87 PID 948 wrote to memory of 3368 948 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff960469758,0x7ff960469768,0x7ff9604697782⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1876,i,13798544940108541889,18230801540773339279,131072 /prefetch:22⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1876,i,13798544940108541889,18230801540773339279,131072 /prefetch:82⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1876,i,13798544940108541889,18230801540773339279,131072 /prefetch:82⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1876,i,13798544940108541889,18230801540773339279,131072 /prefetch:12⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1876,i,13798544940108541889,18230801540773339279,131072 /prefetch:12⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1876,i,13798544940108541889,18230801540773339279,131072 /prefetch:82⤵PID:1800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1876,i,13798544940108541889,18230801540773339279,131072 /prefetch:82⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539B
MD58baf93143bf5e8576b924ea87a8b76d9
SHA155634a8f1cabea0ee286156cb4e086af73f6bb91
SHA256707542548621fac755d8a7dfdf2aca4e3bbeb9c7ca7438a934b976feae363359
SHA512daf8668620fc9efa0317acf36013e693554327eb88bc736d27d35a3ea4fae0025e77751bcdd00724ea8516f00a5bf5310e3009151a83cd852dc544d47f7d028c
-
Filesize
6KB
MD538f3dfa68e1e5ab147c2090439883796
SHA145e28f2525ddc86cecee98277b939bcac0d5081b
SHA256050dd39af7d93c3e7dfb9e929fa45eec93063e4f68ec32b788ca334bfef35fbf
SHA5126273ce6ea2e5c8342987a935d5b3eacdee5f061217b537f5f3514a1a72bb75e4956028bf1eb598ebc15ff85f41ad9c2fb7f5a1d53fddcdd9cacf2754306b6ee2
-
Filesize
6KB
MD526f757194ca0136a939ac0f26ba477f2
SHA10949a092f98fa3b30d5dc1f69e3c71f14cb075d9
SHA256b9b56f862ff3d47cc4cedf2078239637a95149369a82a4a4a3357b7253e2034c
SHA512e2613b6d88b46df38a4a25dac0ddd9514b76b1353e4af3ade87e04f902dc1bafddd406227cc5c76172868a2cb05a5473f8c2b2360d2d5606ba2cfade8363ab7a
-
Filesize
114KB
MD51c15064ab41859b2c4c5177d2b8605ae
SHA1ad53d11033ac2b7b4049709489e03664ebe6653e
SHA256e540c11f1f4b5148a4dd9d2323876a866a671b54d5439bb1e26fe400c34dfdf1
SHA512ba798022554a7aff5186ffb188196384c1e736a503d770823bbc039a1dbca355af8c188b8375d260eb2bc0f0c5e0f159c3e8b42af5c7178bde8e12bd7c460f0c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd