Analysis
-
max time kernel
51s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2024 00:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://go-link.ru/P4YKx
Resource
win10v2004-20240221-en
General
-
Target
https://go-link.ru/P4YKx
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133532936062380431" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2760 chrome.exe 2760 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2760 wrote to memory of 4764 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 4764 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1852 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1932 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1932 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe PID 2760 wrote to memory of 1252 2760 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go-link.ru/P4YKx1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdff7b9758,0x7ffdff7b9768,0x7ffdff7b97782⤵PID:4764
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1676,i,7065147455815492295,17737131210965139021,131072 /prefetch:82⤵PID:1932
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1676,i,7065147455815492295,17737131210965139021,131072 /prefetch:82⤵PID:1252
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1676,i,7065147455815492295,17737131210965139021,131072 /prefetch:12⤵PID:2680
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1676,i,7065147455815492295,17737131210965139021,131072 /prefetch:22⤵PID:1852
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1676,i,7065147455815492295,17737131210965139021,131072 /prefetch:12⤵PID:3936
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3940 --field-trial-handle=1676,i,7065147455815492295,17737131210965139021,131072 /prefetch:12⤵PID:1660
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1676,i,7065147455815492295,17737131210965139021,131072 /prefetch:82⤵PID:3920
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1676,i,7065147455815492295,17737131210965139021,131072 /prefetch:82⤵PID:4652
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 --field-trial-handle=1676,i,7065147455815492295,17737131210965139021,131072 /prefetch:82⤵PID:824
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
648B
MD57787d82f314a0050eb344bbe0a2aad5c
SHA1e0dafaa70679d0598e7dd2111e49994edbaf2495
SHA256fd1546d8280acfc61fe9ddd93e5f00d780895ae68cb923cc61899fb9e28fdc0f
SHA512730527847a94a2d3219398a081d4f5f7529bc0aa19ebf6ff4b52d50762ee91c93ae1408970f8a3ca86e1d2cb8f510cfe7da8e603e536ff69afd5f6322440e6b2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
868B
MD5c3a3d63bf8f562184edcb3e300f0e036
SHA1c72467046ebe08a21af012301ca26488d15d921c
SHA256d7ac229d4b442f3c09ca44f1db43dfdfd464b06babb4b4d04b7ffd00d515d949
SHA5128fb1c7a1326227087e51b02e941a1489e862a6982b70dabcf15fe08be828c8740b09f5f9c9af107308415469c1d6c81cf3b59ebefff8d9fcc771c5d02ce5896f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD593d39d8c49e73ccfedfa0b54de50ac9d
SHA1615966d6ecac1a04f096a0e79048991280533fcb
SHA256131b93b944b7d11345f753c434e30cb0243c08bd1eb1bad3f9f89f6863e7fd1c
SHA51229c23bdc55183031cbe81c2022ddea0f50c3d129b8651d84c7d89ccd05633c122211a84d89d22ef156e7c095f112e44f007e966fdc2f79184dc4920238c85926
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD53650c8694e92185123d484f76a359cc6
SHA1c7d48b7525b1389f28355bbdda8dae1e77b9578c
SHA256d47049697698c8e37fb25ffc67f778e88684c9f0a74bd138187f2d4c7bbb345f
SHA512a17df016a8bb91b3d31013ea689b2ac5b195d635bd36825ee49cec126e576c5437d2b186a3a661a19ae0474246637c89553c0cab08396ffbeabaae22219b8123
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD551501b777352af4c1a93692f285f6453
SHA161e9e7185710c89667922f4c5553f15ca40dc045
SHA25646de24da199cd8904e20fbb39e95eec6b19a229ce07727daefd5b90b9a729e72
SHA5128b5b11cd8f25682af32d2ada62764e42194e4ff1d4d0dce8f1c21981b874a0068794be27b43acf1d6c9a89d57ff60ba46b1540f5dc72394d8948b8754cc04998
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
102KB
MD5222ff6ebd6bf94c9941588d45045d950
SHA110005a85b7d077d4207b34512a307efa57ae523a
SHA2561c65d62451805c61d501141bad9404c7cd928a052b6292d1d3c6c7c6b286a9c3
SHA5129582c52f0822c3457b2676b595158ceff3fe5dbca3efeacf0931665f8f93a45fa305364ad01dffe037cd585b5f137bb300207f8e4414930850f0cd6b11b898d1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57afa9.TMPFilesize
101KB
MD58eab384cbcde9b846396a089b7085985
SHA178f7284c830d3c6a167a650311356d45b7204343
SHA256e51f588faaa16a0b973163d11d19e953296b1b23e2e681fa34eaf3ed17eb0f09
SHA512d06d8de906528e2903870c72a139d124d0fc4927614c162ba59b67d72865cf6aa116bf5b9cf6244be85362c71deb82eb726eb5089a417d04251e8da737c8292c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\pipe\crashpad_2760_RDZZDQRCQHGFJDRIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e