Analysis
-
max time kernel
1200s -
max time network
1172s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2024 12:01
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://datingsr.com/new/?s=96&&&159084635893814&di=7g-881&ed=jio&i=admin96,61808,grievance.officer@jio.com,Grievance.officer&ts=1709896940&292089591477997
Resource
win10v2004-20240226-en
General
-
Target
http://datingsr.com/new/?s=96&&&159084635893814&di=7g-881&ed=jio&i=admin96,61808,grievance.officer@jio.com,Grievance.officer&ts=1709896940&292089591477997
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133543732813157938" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3940 chrome.exe 3940 chrome.exe 4040 chrome.exe 4040 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe Token: SeShutdownPrivilege 3940 chrome.exe Token: SeCreatePagefilePrivilege 3940 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe 3940 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3940 wrote to memory of 5028 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 5028 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 2964 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4572 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4572 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe PID 3940 wrote to memory of 4692 3940 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://datingsr.com/new/?s=96&&&159084635893814&di=7g-881&ed=jio&i=admin96,61808,grievance.officer@jio.com,Grievance.officer&ts=1709896940&2920895914779971⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff9be9758,0x7ffff9be9768,0x7ffff9be97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1664,i,2307817177376991118,7650949914449287893,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1664,i,2307817177376991118,7650949914449287893,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1664,i,2307817177376991118,7650949914449287893,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2816 --field-trial-handle=1664,i,2307817177376991118,7650949914449287893,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2820 --field-trial-handle=1664,i,2307817177376991118,7650949914449287893,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4524 --field-trial-handle=1664,i,2307817177376991118,7650949914449287893,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1664,i,2307817177376991118,7650949914449287893,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1664,i,2307817177376991118,7650949914449287893,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3164 --field-trial-handle=1664,i,2307817177376991118,7650949914449287893,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD5b877a174a156e362172dc8d583b96efd
SHA111f528541ecdf2b990d871ace72c06b550e6bee8
SHA256689c52d94b3cbe33be26953b36554bce3ff4b471c960301f4953023227988a37
SHA512a64b0999b28535b6c9cddddbc84035c906ee48dd22c9ed69b251cc0c5fff2fa2d9e1ec43d7fcefea1a1feeeab6bc9f5d0dc09f5a3d362b5b5d8396d42a60ac67
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\025a7edb-4753-4c8e-bd62-7121c3c4f5f1.tmpFilesize
1KB
MD549c2e514b7de8dbc7e57a9d9df1fa38d
SHA1200b28ce52fcf1f08c4dc4a27117001dc49cc929
SHA256c19a930fe3fa94c0dc78a10f112b2140a44ff9835f153b7793163e4404badc5b
SHA512057f39fa3c54022c4c4842b41a5f9db72643893eb1fe09c6309f43090f205c41aa75b5b07b80ef2f206e3a400da5d918a361fa1d484c3df924dc84f5bac8d880
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
706B
MD561ccd0cb484e8e015f60f32e638f2d0b
SHA1f6248d2d92a1f30f0c47f1b5587291cc18eac33f
SHA256f2cdca897e6225d1d98824c47f53a3e8331a73fdc7ad9ee1bfa589f9815a1be2
SHA5122fe6fd6fa4e68c9b37e3229dea724846077fe05d041b2e3dbee7ac057cb554fa02dbeafefbab06864490f37b4ea71389592aca4e8275438c7de6c5fc8b72c3bb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD521e5e55fbee5a98dd828daf3ad088c91
SHA1f4eb63df43574acfc620e589aa6475123ad1b399
SHA2569720bbcf8fc3d861571c372b31a3a3bb73900a125b34059e5684dad8da49f28b
SHA512c2659913316de8265fb3e95887fc5f3bfa3b9039df8bf97ae7679fd3357f8a513b03707f261faf6552b5b499417210e178e76f52792eec088b02b63925076526
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
128KB
MD57d8b6905e2f930e0595ff693f34e7b8d
SHA11897b9f3328eb13beada9f4faf185eb7fe8ebc12
SHA25695b6213557b4b73cc69f99e48358be0a4fb12b9bf2a8998e1f2cd7c793a6cb2a
SHA5127d8893d7a66256bb75c22249b85672d4ba37c595242bb157c2dc49cdc2aa81990919ede2994b187a6f07b8b162cd47584067d3c52962184053addc2bf4dc3d08
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_3940_HRGAKRGDHZGNZLLSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2552-95-0x0000023044C80000-0x0000023044C90000-memory.dmpFilesize
64KB
-
memory/2552-111-0x0000023044D80000-0x0000023044D90000-memory.dmpFilesize
64KB
-
memory/2552-127-0x000002304D0F0000-0x000002304D0F1000-memory.dmpFilesize
4KB
-
memory/2552-129-0x000002304D120000-0x000002304D121000-memory.dmpFilesize
4KB
-
memory/2552-130-0x000002304D120000-0x000002304D121000-memory.dmpFilesize
4KB
-
memory/2552-131-0x000002304D230000-0x000002304D231000-memory.dmpFilesize
4KB