Analysis
-
max time kernel
300s -
max time network
306s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2024 12:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://go-link.ru/jd5VZ
Resource
win10v2004-20240226-en
General
-
Target
https://go-link.ru/jd5VZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133542014987932386" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 544 chrome.exe 544 chrome.exe 5836 chrome.exe 5836 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 544 chrome.exe 544 chrome.exe 544 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 544 wrote to memory of 4148 544 chrome.exe chrome.exe PID 544 wrote to memory of 4148 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1524 544 chrome.exe chrome.exe PID 544 wrote to memory of 1668 544 chrome.exe chrome.exe PID 544 wrote to memory of 1668 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe PID 544 wrote to memory of 3128 544 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go-link.ru/jd5VZ1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd20599758,0x7ffd20599768,0x7ffd205997782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1880,i,906504836925047884,9217764316671419949,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1880,i,906504836925047884,9217764316671419949,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1268 --field-trial-handle=1880,i,906504836925047884,9217764316671419949,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1880,i,906504836925047884,9217764316671419949,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1880,i,906504836925047884,9217764316671419949,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3736 --field-trial-handle=1880,i,906504836925047884,9217764316671419949,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1880,i,906504836925047884,9217764316671419949,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1880,i,906504836925047884,9217764316671419949,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3804 --field-trial-handle=1880,i,906504836925047884,9217764316671419949,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
168B
MD50bd524f3c7b3d7a5e2c6aedfc196c64d
SHA180a5336460858c10698273253d0342cda55b669f
SHA256aa93fe9766c45a7ce2890f8238c800aa6af860b06333f97e9e95883bc818f083
SHA51282f93878772e2417b67c7d4262c99c55b6630cf3818442ec22bfd27378d2fb638e3a7c7fb84b7dd77c5da80e2ebf841d5b8f6411d3a4948e842731547c6d4093
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5088b475502ad5e4f653e76091842974e
SHA1ad426b17a8b5483246c8189ba49c003c0f87f0fb
SHA256cf32ab51b8d13c18f91266a6d42ea496b4378ae6cdf1b89c0284fc91bc33ee83
SHA512b2168af17f76a189289bdf2d18c7e3fb65ec1ab53a8d540337124cef53f3ee12cd8dce64d3cb5e895f71d81edda13f05db79156bb14aa1a557dbbb249d9d1eed
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD50870faef47880f0887074462d5dc1599
SHA17cbcc222f6dd577b5b21d5fc7d3d337e8cdf85c2
SHA256857253e1f9ef43f8d9eac13bb141d526a59daaf0ee7f57cabb1766babe8c67b4
SHA5129136255ad8ad32f85006a4ba07420530e0f0e0ef07421092611324ce4fd96bf77d09ecab32ce221984adfc3a6d77df4f9f36fef8bffd21b7e58f6332eff0ca2b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
539B
MD5f00abefd7ccb4f5b2933ced35bdddbd6
SHA16b8563409bc787734d0e2255a505a0834fcf2475
SHA25629a758e82da3833269d63a2dd54efebe1fbb5e52693126e0442c532611158d8f
SHA51288f9dfd852742fc3f92bb5c4a25dda58412433c156b0b8b6efa071f3375385761198794b0614c85814ad0fb3d247ff838fb412f9355b55074e9920079d5e9554
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5729b136532d93a4fa5120d9ea4449e15
SHA14c025a96929c62d674b5ac7fa9b5f313bc847d30
SHA25620cd13489b65f4fad8c1c8773fe05a2e7ffb88141bdb866fc093fa9a03c9f0d8
SHA512e163f602fac2b4e808dbb7709bdf4241fd2e47ffdff937a67180a1b9245a6a3a4ea5ed55134430fc3945ce40247b414f11bda2dde82c539d2bb857d66e24228a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5fa57d605cc9d8cbc7e588eb8ca6a13e7
SHA1b14810099a008bf94c87a0a4a1083493ebdc4053
SHA2566a0ae6ca378762c1ce4bcc4c67b47f8d0a0861b92c04d38948d19da16d45490f
SHA512badcd63506fa665b120c7272c97e5914e07443a11c01922c02ef24f434b18b076475035b75d4d1afa5b2881c8b6fb5b6b7c9043de009572db6fc071f844aff72
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
128KB
MD567122ff00f9c9edf040fa0a030762b1f
SHA169682ab642f98c3e71d17ba6fa92333424245c94
SHA2563104088dd9edef9a2b6a0fb2d8b7115836cca0220809cf08b511f225ce9b7795
SHA512321da92fe1a905107abf8e2549c327c223c033f8d099300bc740926c888b2275f2e6a7577c7ee4dc0a54fded3b63e9be3c2950f17825d125862a09d10a94c8a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_544_ATREDDBWJWJHJCSYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e