Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 03:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.avon.ca/repstore/kellycolesporter?rep=kellycolesporter
Resource
win10v2004-20240226-en
General
-
Target
https://www.avon.ca/repstore/kellycolesporter?rep=kellycolesporter
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133535658681462260" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2748 chrome.exe 2748 chrome.exe 3404 chrome.exe 3404 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe Token: SeShutdownPrivilege 2748 chrome.exe Token: SeCreatePagefilePrivilege 2748 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe 2748 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 932 2748 chrome.exe 58 PID 2748 wrote to memory of 932 2748 chrome.exe 58 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 4944 2748 chrome.exe 89 PID 2748 wrote to memory of 2212 2748 chrome.exe 90 PID 2748 wrote to memory of 2212 2748 chrome.exe 90 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91 PID 2748 wrote to memory of 4780 2748 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.avon.ca/repstore/kellycolesporter?rep=kellycolesporter1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb60569758,0x7ffb60569768,0x7ffb605697782⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1800,i,13265165680975015284,13132851439769870780,131072 /prefetch:22⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1800,i,13265165680975015284,13132851439769870780,131072 /prefetch:82⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1800,i,13265165680975015284,13132851439769870780,131072 /prefetch:82⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1800,i,13265165680975015284,13132851439769870780,131072 /prefetch:12⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1800,i,13265165680975015284,13132851439769870780,131072 /prefetch:12⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3984 --field-trial-handle=1800,i,13265165680975015284,13132851439769870780,131072 /prefetch:12⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5260 --field-trial-handle=1800,i,13265165680975015284,13132851439769870780,131072 /prefetch:12⤵PID:2988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 --field-trial-handle=1800,i,13265165680975015284,13132851439769870780,131072 /prefetch:82⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1800,i,13265165680975015284,13132851439769870780,131072 /prefetch:82⤵PID:3976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4736 --field-trial-handle=1800,i,13265165680975015284,13132851439769870780,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3404
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
195KB
MD5873734b55d4c7d35a177c8318b0caec7
SHA1469b913b09ea5b55e60098c95120cc9b935ddb28
SHA2564ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d
SHA51224f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308
-
Filesize
1KB
MD530c603a60e58df9698936e7bd4b95173
SHA1fa6c33383f0f71911339ebf7fb64c79c1eb7c811
SHA25650bcf669832ef3a6b3de45ab2b4f1b796462081995b0dd38a536ec89502461c7
SHA5121d5f10d7296ff88d24a6ed928687dd14f2c864e1fc4b4b31578e39ebc960f5a7d4c87265a4daf3f9eb47d53873901fb8ac82b4be19469407fd08400acf887a8f
-
Filesize
1KB
MD5f7711455199e0deb7e41915ad3c5fc48
SHA159b0d2f5abf94a7f95ee18b9e57a7596927777dd
SHA2565dfc305c36c7cadd3c86a31e10b2cbe5d8a2147f1a167f6a2e6866d33894cdc2
SHA512c5a61096f6a50504735969a8405b05026ccee01a441ae9eb4e733dc85c747c65cd03d2581619b3182b0b603f531963d047ca5ac0be0742df22b444d99135942c
-
Filesize
3KB
MD55dad5a4940e5c814062c143a302d975d
SHA1fd241b5a922c78183169b57e288a5f36ba1219c8
SHA2568fa444835634606fa697c96ca8874cc16e0ef9dca1f4238969e8c4686e71cd5a
SHA51241fdf4809b14fa71140637b46f73debeb247574e4c292fff26c6c59ac997487cb78089b5584bb8ba2544d361a35f78de15d9587ae4328831fc9beabdb65e2a74
-
Filesize
3KB
MD5e8f8bb985a279c1524a0ed9a9c9945c1
SHA1add10a53bb709276b1f48df8445a81c768a36910
SHA256be681d665be91c4cd256220459f79d02105b1c3b4901deeea8b99f93eb21168e
SHA512c30085c67c99658c2143bb538f1ecb7c9b82f9479255b7f48a2414d8cf4cade275ae688989b9e23fc02efd7dabe660f767cf715ad1da93a0a058872855038485
-
Filesize
1KB
MD5fc0a81000ab1927e228d09fec0e929a6
SHA1467283afe8e1c5ac6d1c2e3c2b1435b77c12c6ec
SHA256e91bafe60c66db74c1138f12f3b8f2ee4fad067346cafa2eb780c60f6447ef1f
SHA512a6fc063d7d4f9ba9759d138ee993d322efb10e12aff9d316c73ae6c38d81d75778063150e047eb0cd45a7a6798532ba96da094c4b7902ddd4267fa1c09e5104b
-
Filesize
1KB
MD549661fbed6c9dd5b50461d399269ec8d
SHA12d7ad62f4671e36570d348be23b3973aa3fee59c
SHA25611c382e2f064aab01a688ce0f324fa88c1b21d373cf168b7d9448b1c900f0f2d
SHA5126dcd46952d9ff196f5c3da8ae738873e4f75d85b7a96fbcb280fd21191b0d0951c2907ece54a02e86917cdaa7e1d65bbe53a1aa27799add9960997c59cf1ef7b
-
Filesize
6KB
MD552eccce69a5f60b4a8835e07a30f4edc
SHA11a6206d2deb2ccbfff3174d8ace5d3bbda5e8900
SHA25664153f9990930b5d3ad0865bd2cb7640fcc3b30dd7b597c1860358527cc45862
SHA5127d4b0910c99d4e07db9f8e6b6c8b121b0b72bf81ac6f0008a15e8bfd634a771616e982d3af5ed686f2df69dc6d88d497a63af67f33c93732166aeb254edf3420
-
Filesize
128KB
MD58e08bcc01c295c29b55c7bebe2b90ac6
SHA110b7b399564a0074dc4b8ebb963003720ec40521
SHA256e0a75ac12a82c19c229e15787f14897b4ef147c05df425b04bd148c7b6d80b2c
SHA512069a1b74ade22eaadae514ba2ea18d23c38a69d8fd671a0bbf522c95e4d5742cc63d5c5a9b6d246fd011dc9d019747ca7d942dcde42911fd43740abe13e39ad2
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd