Analysis
-
max time kernel
600s -
max time network
578s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2024 07:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://10point.cmail7.com/t/d-l-vurjrul-drtjdjuhlu-jk
Resource
win10v2004-20240226-en
General
-
Target
http://10point.cmail7.com/t/d-l-vurjrul-drtjdjuhlu-jk
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133541828552619014" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5100 chrome.exe 5100 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5100 wrote to memory of 212 5100 chrome.exe 89 PID 5100 wrote to memory of 212 5100 chrome.exe 89 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 1480 5100 chrome.exe 91 PID 5100 wrote to memory of 2872 5100 chrome.exe 92 PID 5100 wrote to memory of 2872 5100 chrome.exe 92 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93 PID 5100 wrote to memory of 1604 5100 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://10point.cmail7.com/t/d-l-vurjrul-drtjdjuhlu-jk1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb51999758,0x7ffb51999768,0x7ffb519997782⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:22⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:82⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1776 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:82⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:12⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2920 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:12⤵PID:928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4972 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:12⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3232 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:12⤵PID:1416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5236 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:12⤵PID:4292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5396 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:12⤵PID:2496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:82⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:82⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 --field-trial-handle=1964,i,11743722606041290008,7485364390739193250,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816B
MD55d4da92649e0ec6f7f2d96c4b59efcd1
SHA188b0c162ed6c822392ccf2ca5cda1755536477ea
SHA2563da16536cffeeeecdc7b42cd9fee00cb38812ab99ee3312f57032790e9f46e2e
SHA51280c1cd5412b07330f58b3a70dd5aef669c3fb9f9245cbf15eb7575528e552a95c01da1d1248d39992447d28441ae860478c5bdd5ecd4471999c0b1faea4ea501
-
Filesize
1KB
MD5c93d636988c428c2f4ed6e0aa1397b54
SHA195d5d37b82e3132022f0d73979ac35e95f225b86
SHA2566ede10b3ab2c7d3f41dc1e1b91ccc891ffdb2fd0f5520faa5c4d53035b194f00
SHA5122c96e62dc985b50a51fed883c7114e21a1b91d7b36bbf72cfb6251f8aa922ddf5c797401593011d1cc787327b3b5b7f5d89db815508ccf0d79dc863debbbd7e2
-
Filesize
2KB
MD56ba381d1dfae023c8900b6fb7379708c
SHA1377ead483af49432fd7a35f3f048244565795373
SHA256bfa61a6fd1a73a1642d353c68cf502029e07b208bbed4f17b5875af42862e2b1
SHA5126c398698b78858a96b1721ae337332b0eae1508100f35dba2a09b61ff4e6b803656511ad48a23456d27d89f79cfccbf111673039473ce27f75bccffc39ce9db1
-
Filesize
1KB
MD5df1c7edb43b5f0f156e61cf441509590
SHA122c3fbfbe822d95f818447784a46dd21f1cd319b
SHA256b0c91055b868ea9554bbfa1b81b712e33dbdc8af10ea6ec346763376c4ff6fb4
SHA51249afdcddf6d591abf40973e28e196a24e95df0ff69ae636d10058187b70751b34b32c946bb22b5bc8e54427b0264ebf2b3970263bc8733864c12c19c71411075
-
Filesize
6KB
MD5d8dec77a8815aa84b2d1a0bc7c91942a
SHA16db2fe8b918a6d34041eb17549feb265a0f7c114
SHA2568e91b045995c2040caaa6ee5f2db976b29cc6f672a43a72e81fdb5fa1a92a76a
SHA5123ed544d93739591dd227e478242149238dc0e8a1cf1fffdc731cbfce38d225e99a45dfeb5d17bdac9362aef5ec612267dff5b81de5e1ab9d30b102066d81a345
-
Filesize
128KB
MD5a85ac66a5636c76d59e6e8f122d219da
SHA1aa00ba14077a05679fa6d6f4f9cf8bbe080905db
SHA256b54e3ff72950f8e56b51894b87e03b09bb10dc9193a79e7912a3f5eee5bd4399
SHA512ec4f01c4e2af4edd3bb2c0fd62fb9ca3e780ba6a797b13eadd064088e2bb8a541f5e6702ca7a0eeb7bee33afce7d1259e3b87f3c8f642fe7f33784b7f9aa2f12
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd