Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
06/03/2024, 15:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tinyurl.com/4jym9n6a
Resource
win10-20240221-en
General
-
Target
https://tinyurl.com/4jym9n6a
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133542112698022081" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 4624 chrome.exe 4624 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2928 1720 chrome.exe 73 PID 1720 wrote to memory of 2928 1720 chrome.exe 73 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 2560 1720 chrome.exe 75 PID 1720 wrote to memory of 5068 1720 chrome.exe 76 PID 1720 wrote to memory of 5068 1720 chrome.exe 76 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77 PID 1720 wrote to memory of 1948 1720 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tinyurl.com/4jym9n6a1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff15f49758,0x7fff15f49768,0x7fff15f497782⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:22⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:82⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:82⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:12⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:12⤵PID:3580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3616 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:12⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4760 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:82⤵PID:952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:82⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:82⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3152 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4896
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1e41⤵PID:1968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\61e5019f-deb0-479d-8940-e2c93a80eed5.tmp
Filesize5KB
MD555b39562e708fe5796cf9b41ed086662
SHA157b22f68aa54faa2dfae7cc86bf24480978f1712
SHA256b746ed9843ef1171324c6838511642127e060519b4c29546d37e7eaa0dc1efdd
SHA512faead73d223b5c538cfc56a5af1d380beb2d7951058b8bbd1aea8a85b1404a12b909cc492a672ac7a302809208633c62e72ff9f6875db7e9fb60d7529ffcc3c8
-
Filesize
1KB
MD56be56255fb53f1fc2760e0b5fbab1955
SHA17e566a6bb7d063d7e4ff510c5d217e8b35e227e0
SHA256ccad380cb9216b7f94169d01b2e6ef32a5147770a3502663e92f991b062cbc9a
SHA51231b8129280f96de22ab026926e36ada3b558a4745dc44ce0b392b9385bb64e835b684d34325332bb08ca73e1f3bb16e92b16566544855aac8e05ea173c1d4dbb
-
Filesize
4KB
MD5e23d2ae3f65e0d1e069cf72b689bdb50
SHA1c9a200cab7a8c56fafd97cbf1b74c9caab37b497
SHA2560abed220a16c2f7684ff6140cbd8c24c443bc2e5f639899f5a125b2bc402cb2f
SHA512ced02adafc4c663b12fc71afcb8e92146c496fd990430bc5e760b8d354f2a51064d0657c4d57e2add1ce3016e7890c7a5bbd520a2a1863ae05025e45edf09f82
-
Filesize
2KB
MD5d02c673c9d8b921d44d5c67180d7991e
SHA130292366408ae787bc2309949873892d94d74b62
SHA256f86ee42777b2eb1a2bdae45d668966eef55bf0a084d9b9c39b2ef8890031d32b
SHA512d1a6cb98cea8723eb2b716ab164f1dce940dcbe5b28f28d6fd61fd1ee5a712c065d98460990874107e9ceffccd5f8079e41993bffccbd7a1a05b1f7415303136
-
Filesize
2KB
MD540f994ad73a00ffdb4a75c29a9d42b08
SHA1c266adae06f2a80acf916fcb5ba3bc548c2babfe
SHA25664daa32458045bc9592c5ad729d91484fabbd1662ef79dd5678c8ba40c38bda1
SHA512814be32f4506ac0ef56f7aea0d42b45119f45ecf626eded5ece66b4655c7c3bb3c708104956e602b207c567dc99ad648d16d4f81e30e615355a23de4e9c42daf
-
Filesize
2KB
MD5157223fd9f9e3c77342c2dbcc51e07b5
SHA1398f8b4d2adde8d164072d8ef23efdfe310826ba
SHA256eaf69de62c5d5987d83949f2ca2c5f24a70120a1beb6cecb857f541c08f27627
SHA512268689c59c68227ba1e2ced774406eec104c65d79834d2de6b1ef203abe035f4e378389e8aa34f60d5eee3b821b5236942287b2f89fa611ad1f6810e201ead8d
-
Filesize
5KB
MD5e308cf61619dad517a89a13a8a212d7d
SHA160cbb42b473431d491066f236fbefe64c6d997b4
SHA256577a582cbe2d4293d367b542fe4cd4d8588dc09605b3fa94412f9d7f5e8606d5
SHA51247121c8f708ecd2f88267f2fa8cbd9d1667856af8768a20667aa811e56dbb73a455e49cc72e1d71ded52394010f4f4efd021737cc942ae303ea330f209ade17e
-
Filesize
6KB
MD54a5ac98735c7fd66bdfb9efb7165d08c
SHA15cc7367645daa6c6b3783c41caad7eda816a1a04
SHA256f42e44f144d7a4ce1ed41b8d898cbb054d8b7e0259420531b4ea9825956adf82
SHA5128195a24ad27b17e67db1ba68cc53b8998a65eea413497b87c529b7a736c6d215a34b5a82315cd0d9898f3d0a26b7dd07352ce986e1f16aaeeeaa798c3fd3965b
-
Filesize
130KB
MD5550abce8af088acf238fb8f77ca367d8
SHA13dd089f5860d70488e56ab88b2747499da09adf3
SHA2562723facf801bef3ce1f69e8160d86d68f7152e404241d7d62256b2e745b35698
SHA51295834a3c06268049f61143f662d1d155099b6ec87d65b8bdd8d91e65c4c855a8854c33a3b2afa20dd2698ff54df30d7662cffe044f1307e18759cf583b22abb6
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd