Analysis
-
max time kernel
104s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 20:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.warmmineralspringsmotel.com/rates.html
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://www.warmmineralspringsmotel.com/rates.html
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544049064400823" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5900 chrome.exe 5900 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5900 chrome.exe 5900 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe Token: SeShutdownPrivilege 5900 chrome.exe Token: SeCreatePagefilePrivilege 5900 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe 5900 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5900 wrote to memory of 5624 5900 chrome.exe 88 PID 5900 wrote to memory of 5624 5900 chrome.exe 88 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 5924 5900 chrome.exe 90 PID 5900 wrote to memory of 6120 5900 chrome.exe 91 PID 5900 wrote to memory of 6120 5900 chrome.exe 91 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92 PID 5900 wrote to memory of 4688 5900 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.warmmineralspringsmotel.com/rates.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe08db9758,0x7ffe08db9768,0x7ffe08db97782⤵PID:5624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1952,i,13271606450384956786,861678756172549730,131072 /prefetch:22⤵PID:5924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=1952,i,13271606450384956786,861678756172549730,131072 /prefetch:82⤵PID:6120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1952,i,13271606450384956786,861678756172549730,131072 /prefetch:82⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1952,i,13271606450384956786,861678756172549730,131072 /prefetch:12⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1952,i,13271606450384956786,861678756172549730,131072 /prefetch:12⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1952,i,13271606450384956786,861678756172549730,131072 /prefetch:82⤵PID:3412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 --field-trial-handle=1952,i,13271606450384956786,861678756172549730,131072 /prefetch:82⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD5364c3ba0e9cc619e4f05649c08b59ca9
SHA17f2cf5fa6e1997f23b209d5329bb05e1318cf7f7
SHA25660d8a54ea6df777b31cd61d45595394d15c31aedf7083ef05a94eb7715f97731
SHA51227d880473670ed19c9cd7afa552a65a1efdff63727409811330a801a7cef32d3c408666ff640c0565331f3224a911c053e2de3b43f788ea005709161410cb364
-
Filesize
6KB
MD56aa00fa7d67a9c5a4f432c39cc302a06
SHA1190b2d8e1cd7d457e1ccd51e335df463e9a3a3d5
SHA2569d5ff6f406aa2cda2c0c918037554eb3101d9d5cacacde70cd1c93704b2a021d
SHA51275c0d90c13196392c4c91118e76e719ed6a6806d4c551ca982695ff58e5b980867742c0d0c8b7bf08cf45815e1278f3115deaff4e2c5a478d5534051c94c007b
-
Filesize
6KB
MD59f5d4c82259a854d742bb4d3e0f241f5
SHA137b85f7b26f368cd02986abccb7143a1db55d6a3
SHA256a4fdf4cf4137003f78541919204f88f2fd94640af6235cfd313a991ab47a772e
SHA51232ef6c787d38606508b6bc07a6e892db3c476a0a6d3372919a0a9ad44b3d6298d6a5207ac4ffca26df6e64e4b98f7644c7055d2ba52044c9699885ec8c40ad4a
-
Filesize
128KB
MD5e73929429b952d8491d58765270303fa
SHA1b7a22ec9fed495891dcdc85f52ae4908e4e43807
SHA25620a77c5f7b63bec0c2607299e6d820ecb506f8ceefbf887a156aca3b71968d2c
SHA5121207e71cd09bf53c9b9efdc088daac0fcc25df421a83001360481ee18e4074e9b8dab4956d3fb71337ef0a60e89840b9d1d8e2de2c4faf4a792778ecace13dc7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd