Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2024, 20:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://081cafe.com/images/files/Dinner-Menu-New-10-2023.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://081cafe.com/images/files/Dinner-Menu-New-10-2023.pdf
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133535409878933724" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4952 chrome.exe 4952 chrome.exe 4996 chrome.exe 4996 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 1824 4952 chrome.exe 27 PID 4952 wrote to memory of 1824 4952 chrome.exe 27 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 2916 4952 chrome.exe 89 PID 4952 wrote to memory of 1432 4952 chrome.exe 90 PID 4952 wrote to memory of 1432 4952 chrome.exe 90 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91 PID 4952 wrote to memory of 1980 4952 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://081cafe.com/images/files/Dinner-Menu-New-10-2023.pdf1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdde519758,0x7ffdde519768,0x7ffdde5197782⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1872,i,11534388632799306584,14302188463376515300,131072 /prefetch:22⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1872,i,11534388632799306584,14302188463376515300,131072 /prefetch:82⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1872,i,11534388632799306584,14302188463376515300,131072 /prefetch:82⤵PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1872,i,11534388632799306584,14302188463376515300,131072 /prefetch:12⤵PID:2408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1872,i,11534388632799306584,14302188463376515300,131072 /prefetch:12⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4600 --field-trial-handle=1872,i,11534388632799306584,14302188463376515300,131072 /prefetch:12⤵PID:4252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4804 --field-trial-handle=1872,i,11534388632799306584,14302188463376515300,131072 /prefetch:12⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1872,i,11534388632799306584,14302188463376515300,131072 /prefetch:82⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1872,i,11534388632799306584,14302188463376515300,131072 /prefetch:82⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2672 --field-trial-handle=1872,i,11534388632799306584,14302188463376515300,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4996
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cd3c5e6bb33c6d4094a49b59fd2ec857
SHA19f016f2b73e8c7c22e4f87dd5abede83aeff7eb1
SHA256e5b237e0b87672d4c524add21789bba9f50b442015ca86d9c1d91a5a172f659e
SHA512e1c785e868cea1c1baa967e5a76e79d66f38a7bfb9f27a0b8974a2db38aacc166b4c9f6f016225d39b7a9e2db785a1fcb83b0ba877e0546ce3d74ba60c92d857
-
Filesize
6KB
MD54a1a9aad143a0fa01e7118ed3aaf8dd9
SHA1dfe9e6c53caa349d389fb5d9d7a6d28615a10d71
SHA2560312d21beb8dd8038c214d8603643e2c8194d27e0229ed7e7dd06e43749954d1
SHA51216dc14d28b9a55be178f85efdbeabe2610f92c6d6d076a79bbfa7b7bc6db497d887bf4c345f7b5f9d4b72ab6905096dae8de8df7907623c5a94579233d704e83
-
Filesize
128KB
MD556db6a7a63af23e3416478daff5a6f4a
SHA1183e75fbf1ad998d7268748a76455c362bda2d4d
SHA25625ce791a96f439de5eab7f50846aa6c0bcaf56cc7ca3910e9e3d3600a017278a
SHA51291d3a15f41a5ea2ee48dc9636013efc7c2c9b6cc6ad64426ed068123d182ebeab20a9af89194595086b78c3263889a85fb9d283e7361aa24b3f432ecbcbfbaf8
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd