Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2024 10:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sum53mitru.ru.net/zdpTdQ-ZckPeK-DPaEbZpx1zGCUcUFHjE-BqupcSiM-NwhigHQFYo/?cIEpWOhOe-FTqTbTQ0hMBBCU-yEgBPo
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://sum53mitru.ru.net/zdpTdQ-ZckPeK-DPaEbZpx1zGCUcUFHjE-BqupcSiM-NwhigHQFYo/?cIEpWOhOe-FTqTbTQ0hMBBCU-yEgBPo
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133541944931055781" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 644 chrome.exe 644 chrome.exe 2212 chrome.exe 2212 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 644 chrome.exe 644 chrome.exe 644 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe Token: SeShutdownPrivilege 644 chrome.exe Token: SeCreatePagefilePrivilege 644 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 644 wrote to memory of 3488 644 chrome.exe 88 PID 644 wrote to memory of 3488 644 chrome.exe 88 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 1832 644 chrome.exe 91 PID 644 wrote to memory of 4900 644 chrome.exe 92 PID 644 wrote to memory of 4900 644 chrome.exe 92 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93 PID 644 wrote to memory of 4684 644 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sum53mitru.ru.net/zdpTdQ-ZckPeK-DPaEbZpx1zGCUcUFHjE-BqupcSiM-NwhigHQFYo/?cIEpWOhOe-FTqTbTQ0hMBBCU-yEgBPo1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c539758,0x7ffc9c539768,0x7ffc9c5397782⤵PID:3488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1700,i,7139609489522704948,3489510727010612505,131072 /prefetch:22⤵PID:1832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1700,i,7139609489522704948,3489510727010612505,131072 /prefetch:82⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1700,i,7139609489522704948,3489510727010612505,131072 /prefetch:82⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1700,i,7139609489522704948,3489510727010612505,131072 /prefetch:12⤵PID:2676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1700,i,7139609489522704948,3489510727010612505,131072 /prefetch:12⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4460 --field-trial-handle=1700,i,7139609489522704948,3489510727010612505,131072 /prefetch:12⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1700,i,7139609489522704948,3489510727010612505,131072 /prefetch:82⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 --field-trial-handle=1700,i,7139609489522704948,3489510727010612505,131072 /prefetch:82⤵PID:784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2608 --field-trial-handle=1700,i,7139609489522704948,3489510727010612505,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2212
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD533037aea432b116a689d13ccb5575daa
SHA16c7872d120ad8f1f3d735cfa1030fc511328beb7
SHA25619e5f825f16bca2b43de8f3fb49ba6050cfdc3d9bcdf76fcd71e1d9847e572a0
SHA512cf32ad3970c98d2cc3dc244a8e297d7e315b37ea519cd1fcd98ee12e848ed01d07be672c60ef31c5aa819e9f04f32a6b7519d288858f4158f284f5f5ca99b5e1
-
Filesize
6KB
MD5e3d2188c0f3bd7bcbd49fd78cc9f2d0f
SHA173d34905e7f9ebd69d5fe3fe8a6d86adc52a8367
SHA25626c7018a14f8442175b8550383def041e50f931a70d2487b87ca359ae2d8042c
SHA512b4f3473a21cd03a0be47a68160bc0ae218810cef81627a82fbd9b32d734e8c3f8dd587c0321f89407e33043658fc9329d74eebad68dd0630e70c306f451619c1
-
Filesize
6KB
MD534bdf57e314e7c4c915fd621a08a6a9c
SHA10c30f2103e29a210a5ce1a2f832a5ef23b11ee28
SHA256d849f2139c601d71dc35abdc421010f9e92899835671f2b3715fb76275194e7c
SHA512460ebe4f29937eb7bc3933027094bf194e2169029f872cd2388e34760bd958090c6a11b7ccf2c9e5e076049507719e6786de047dcbc1d27d48f552252979d8dc
-
Filesize
128KB
MD5ffaab58580a067f25527dc01409d4df2
SHA180b5452e13209252d8f59ae6bca6eea9d4190a59
SHA256b561439302c337dca4e4f38a39efb613a3d1fe4be53824b1336a5ba23568100e
SHA512aafa99d18876c32259839d7f494cdc3e04bb01b4d269bea09d6c2488e98b8f04fc026705f9b2e811765903cb7f849565913c39993f518cd5ffc3c30132998985
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd