Analysis
-
max time kernel
128s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 14:54
Static task
static1
Behavioral task
behavioral1
Sample
Benefits_Enrollment.htm
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
Benefits_Enrollment.htm
-
Size
1KB
-
MD5
af8b7b9f7984fa8b75cfde25672afd91
-
SHA1
8748a75072530ec431a2dae5e2e6f9993a1512b0
-
SHA256
98c891f76d8818bb3a6f2e709b2f05443ca836effbc575afe771468a5fc7c943
-
SHA512
19857954dcac3c3c2d6363cd37206f1783e7abbe45603a2b94690f5b4d81a7d53c5f53e02f2619622f11859f5fd26560a587d44e54ecdd869ce618192f8bf8eb
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133543832890280354" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 2944 5012 chrome.exe 88 PID 5012 wrote to memory of 2944 5012 chrome.exe 88 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 2724 5012 chrome.exe 90 PID 5012 wrote to memory of 3336 5012 chrome.exe 91 PID 5012 wrote to memory of 3336 5012 chrome.exe 91 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92 PID 5012 wrote to memory of 3172 5012 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Benefits_Enrollment.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe94669758,0x7ffe94669768,0x7ffe946697782⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1736,i,12429603815248944779,8706629477761936192,131072 /prefetch:22⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,12429603815248944779,8706629477761936192,131072 /prefetch:82⤵PID:3336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1736,i,12429603815248944779,8706629477761936192,131072 /prefetch:82⤵PID:3172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1736,i,12429603815248944779,8706629477761936192,131072 /prefetch:12⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1736,i,12429603815248944779,8706629477761936192,131072 /prefetch:12⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1736,i,12429603815248944779,8706629477761936192,131072 /prefetch:82⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1736,i,12429603815248944779,8706629477761936192,131072 /prefetch:82⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56d4279a18d60404fc558583a4d754d9f
SHA148b2319576e4e2795f5a39c368f40b36209d81ba
SHA2566477145cf3e8ad206d5847d5cb02306138755ba424ffca7ef7facbb44fe8effa
SHA512357378fe6bc2342009909b8d3d4f1105c47f369c15cd50ef7eed7949efb8936c9ce01abc7d7c38b4bc903abf23f9f007bdff8401ea52bb38f8e73e11e3470b51
-
Filesize
1KB
MD5a0adf307547663342d611dbe3efe42f9
SHA197480d820dd4c215ed4ddbb75652ac4d99ebfbce
SHA2567956b5451f34328ed3744ec1f36d5e8d470f7912721958cd40c49c2e22f86f90
SHA512b8615d42d5fa2104d0cbe0b7ec673a19458769d5a0f9555c4075108993f9fa4f1bba15f1c8c2012c4a48849bba155dd81e2d2204754f5a0810b5b641d933924f
-
Filesize
6KB
MD502fb367ee1e95cf725c301ac5e490e18
SHA13c98985d205cb1306fbf227e3afe372a862a1518
SHA256103510bd952698f2858a9f118d252feea2d010a41c5b88620a9885ebffc7566a
SHA5121b8ed290f4a108022795d840062ad631dcdb8b398e65265f45b93e18ecaf5fbebd7c204f70aa3199a624cacb3b7712afba5e9319b1e9824ce76798bd13e912e0
-
Filesize
6KB
MD5e7ab94b4f204f6e86d786552949e1f00
SHA1bd69b6e7979e701c087bf4d8c4c4b11a82084d29
SHA256079c4e55ee61d440877bc5ad82292df63783ba045eb12b8587850dfcc5b52ab9
SHA512547ddff9ba6ccb5b58a9bccbb56393fbfd5ba42aaf26979fa65286b3dcdec67c3403e9489fb87ae7536b873e7ba984bab1e8e17d314f9c12306af0d776affcba
-
Filesize
128KB
MD56e9cb3dba1d1b28c7f799d178162274e
SHA11c6c94d1c286bd60121e1888f3f3f1fa64a0a17b
SHA256a720bf92f49e91357febcef11009b5a62d9d574700af01e0d313f8f57c605604
SHA5129804719d17342314063231ff3c40c68baf3dbffb80a558157b3163b5f7a3ab1e5029014cdf8b520e5a8306dd91da8da0cb1f1554d391a9fe4e37daa505e06c51
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd