Analysis
-
max time kernel
15s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2024 17:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://skhxkhd.blob.core.windows.net/jlchldl/offff.html
Resource
win10v2004-20240221-en
General
-
Target
https://skhxkhd.blob.core.windows.net/jlchldl/offff.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4536 chrome.exe 4536 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
chrome.exepid process 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe Token: SeShutdownPrivilege 4536 chrome.exe Token: SeCreatePagefilePrivilege 4536 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe 4536 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4536 wrote to memory of 2816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 2816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 1816 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 4344 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 4344 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe PID 4536 wrote to memory of 5520 4536 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://skhxkhd.blob.core.windows.net/jlchldl/offff.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ab559758,0x7ff8ab559768,0x7ff8ab5597782⤵PID:2816
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:22⤵PID:1816
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:82⤵PID:5520
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:82⤵PID:4344
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:12⤵PID:3376
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:12⤵PID:3552
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4620 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:12⤵PID:1984
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4844 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:12⤵PID:4568
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3212 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:12⤵PID:5764
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3064 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:82⤵PID:5504
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:82⤵PID:2692
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4784 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:12⤵PID:1700
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4736 --field-trial-handle=1876,i,11916970473837271528,11751625976151496637,131072 /prefetch:12⤵PID:4176
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5941236eb1498fea21c9bf9f27e9ae8b2
SHA16d2f7d49505f638a5110eade684809193869fcb6
SHA2567424a244fb2c5256b3bbccd67b15aaba886cc456459f17e08aada7218333214a
SHA512b1461b5530670b2b4201c9bcdf6739eb1e933f607955b4a8b3785980ead70e1fd6bcfd1a5ec4ca37485f6bbc6067ef69bf092a351b79215311f25f1d9169b609
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD5c11c794bf1da67ae38e2f510836f097c
SHA119e2751df95d29547e4066d3fd476ec36ef9ab5f
SHA2569fb7ce76b3bd8e88ac1ab7aca5462f183aa5040ffe2c1945131768dbc73d6035
SHA512bb4bdb6dacc1b04a95a14a1348ed38b91b21046f57ee89972b3f34754c88743c89e09aa1a8ca7d2a6044d7e075e7c6d0f263d05c90c158aeef3f06aa3738d0b3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4536_VIUZSBGWPAGILRUYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e