Analysis
-
max time kernel
609s -
max time network
609s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 14:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://intargold.com
Resource
win10v2004-20240226-en
General
-
Target
http://intargold.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133536913041927637" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1356 chrome.exe 1356 chrome.exe 1296 chrome.exe 1296 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1356 wrote to memory of 1796 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 1796 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 2416 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 1600 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 1600 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe PID 1356 wrote to memory of 4932 1356 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://intargold.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff855e49758,0x7ff855e49768,0x7ff855e497782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1884,i,830348108298993471,816137916165355271,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1884,i,830348108298993471,816137916165355271,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1884,i,830348108298993471,816137916165355271,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1884,i,830348108298993471,816137916165355271,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1884,i,830348108298993471,816137916165355271,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1884,i,830348108298993471,816137916165355271,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4652 --field-trial-handle=1884,i,830348108298993471,816137916165355271,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1884,i,830348108298993471,816137916165355271,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5376 --field-trial-handle=1884,i,830348108298993471,816137916165355271,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3228 --field-trial-handle=1884,i,830348108298993471,816137916165355271,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
72B
MD5cf6049048808e8190254ee043ec5b175
SHA1b6aaa6c94545c9e4e9f7483f8d3a66c7b3f40e94
SHA256989ba6d0e3ddefa7ae417f0616263e7151d9ddfc695e1b72e8c8d3609719668e
SHA512bf1d215b61312facd7143991af29ca4e503e1eab30f8dbadb689ab12587f49fe4964f765974b14276532b159ec6b82d5071a0f7254dce1f171b4fce738ee7c97
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD538250fca3a30803614a8284ca401cd23
SHA16e5dc28f6669bbb427cc7242b29932f6bf11e3dd
SHA256fad08260996d8e0c2a3bf4e301bdbfb9edd320ca0a4c92c6dcb37e2f25edfa43
SHA512ad0edf53327dbf9f77c4f7185d2e5504e7b0de9886261a4cba965b79b4cf740eeb85df4e200f0f23224913daa47ce25e44f7435fb5e8e5971dd47aaa613ee811
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD55adc0acdaa2a5b316de28e7cc9e2d40b
SHA16e1e522538eb7abb0ca6175802cd84d82951f07d
SHA2569ba3336015ccc31359aeba46b87e6fcb99a2a2000cca65bd05269154f392f26c
SHA5123e0ff8945c12d8f297dee9caf3420317ec0078841e58c5cc29f454dc13ad1203be73e78b4a786e56bb06b7408e426f543e3218d97388f5e699b854587704de26
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5f98758eae3a8e0f36b50e988eaeb3e60
SHA1fe935f79f47e840d3b4a03ba37a44bc1cde3eab6
SHA256779e049bcb7cfe45bdc275c5b47b4f0c7f294b502d530905c4617cefcdd6e7b7
SHA5129c22b2ceb5dc51f2aff756095eb7aca3d4ed622375a2574f1fc60af067afd0e1ec72690dc87e0aa7535b00500f9c3b9b1116dcae84668a26df60f1adb9102f6f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5e188017fe4c50b8599698a66a1f0d274
SHA15088252726e0821164aed79af37e88cb07b9d96a
SHA256d79b898b782d1424a13011444edd4d0645a1ac148520cab83a3578f6241e6d04
SHA5128bd2cbf7fcba747f54a362efadb6ceee00120cb6298797f0575bbb24a793fd5b3733339dc7282761e5bf1dccbd2091827530b63a32a33290d0e51a61a1f23c76
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD51cbe3d4fbb7432ebc05f054b34ed4170
SHA18aa504df529e671b9c2c38275abcc9eff358d115
SHA2560ee1633ba553b6dffcfe8172b3f5dd6c329599d1c2bd5aa345dbcad1ebe316ba
SHA512b0c2c209a57b868b78542c50a46aa75ef74081ab80cce12657cd4fdaff8fa92eb52ac1c7f466d6d25cbc9483723dee8e8a1e019be42805840dee817709a8e75b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
128KB
MD570d34270b3a87b154da6fcd74aac7eb6
SHA1c86f3bdfe76d039964490642403e09a44d79e4aa
SHA256e5c8532601effaf86ba6878096e2da02fba4249257800df6bf39de65bd6d54bd
SHA5120ce7104cc2eb26cb0fb2517a74407f789c789ca1ea90bff9eb0d40b0a6341a261407fc5c71a37cc2cbc4446e00bdb43e965d146805524b57916bf12b5ef0081e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_1356_ZMNHZEJYSFAGLEZPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e