Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
08/03/2024, 15:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://oswrhylaynkplrsrnwzsamacni.s3.us-east-2.amazonaws.com/oswrhylaynkplrsrnwzsamacni/1.html#cl/24718_md/74/14863/2096/456/1085527
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target https://oswrhylaynkplrsrnwzsamacni.s3.us-east-2.amazonaws.com/oswrhylaynkplrsrnwzsamacni/1.html#cl/24718_md/74/14863/2096/456/1085527
- Sample240308-srzklsad39
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133543849481519425" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1992 chrome.exe 1992 chrome.exe 4456 chrome.exe 4456 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeCreatePagefilePrivilege 1992 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2640 1992 chrome.exe 84 PID 1992 wrote to memory of 2640 1992 chrome.exe 84 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 4264 1992 chrome.exe 86 PID 1992 wrote to memory of 64 1992 chrome.exe 87 PID 1992 wrote to memory of 64 1992 chrome.exe 87 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88 PID 1992 wrote to memory of 3764 1992 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://oswrhylaynkplrsrnwzsamacni.s3.us-east-2.amazonaws.com/oswrhylaynkplrsrnwzsamacni/1.html#cl/24718_md/74/14863/2096/456/10855271⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffcc7149758,0x7ffcc7149768,0x7ffcc71497782⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:22⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:82⤵PID:64
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:82⤵PID:3764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:12⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:12⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3860 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:12⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4024 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:12⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3164 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:12⤵PID:1272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:82⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:82⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3764 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:12⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2500 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:12⤵PID:632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4948 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:12⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4992 --field-trial-handle=1864,i,17060036231507891971,17473971532614166942,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 823B
- SHA256 ac9562f4b23d98240c60011e751737dd5fe6593bab373a45bd8f6d29bb74e85a
- MD5 d613b8c8058f589e66da190eb9451968
- SHA1 106fc17d0576568630da3b06f69d14ac0a2b9a5e
- SHA512 77bab37ecf6dc760da28c8b5a6cd730eb092cbf4b34211497de9feb638277d4f793bcdd73ca989c0145e19bcea5e070040635eccb6363e91a15cc2ec0e5b6e40
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e191dccd-6bc4-4937-9582-aa7a93e7323f.tmp
- Size 6KB
- SHA256 972fffa8e9f71df9ccfe6447462fcba17e8722e7aecb19121fa8a9ce4a2f2c29
- MD5 4c4852c412bb0c984784aaa17f1af294
- SHA1 233ad38fda488d1d8101a907d391e3e68bb10c2f
- SHA512 f25295d6125f2a26dd6962f47e37b212aef38cb7105af0422d9fdfb1de3af9a18afca65111a6c776c5ca2d0227f886c28c595cf1883d4ad44712358e07306f7c
- SSDEEP 96:BDt/X1KImav8iZRy7Di+6MsmdeV/kqIS1HOGNptjVhYtjEsXt0/cg2Vup:BJ/l78syy+FUkqH9otjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 114KB
- SHA256 39aeb95a9342ecbd21cb290d1c2b1bc1914c444635676141fa525ec9569b788b
- MD5 22fd79bf94dfc16e12c8942965c623be
- SHA1 ebff07ecefc73108e47f1adafe7ce469b1d0cecf
- SHA512 13c70e9316b0f1bbd49b4077d68faf130759515e0054fb16ffc4e4cb6507672b38bcffd8c9544a7aabf43bbeda4c3435ee94a56063a7544f697ba76233f9bb8f
- SSDEEP 3072:cjl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCJ:cB+70xBmboJnf9/To/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512