Analysis
-
max time kernel
299s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 11:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://<@711568670232543234> https://getmyfilenow.com/lp?id=Chat%20Bypass%20V2_97941654 is this a rat
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://<@711568670232543234> https://getmyfilenow.com/lp?id=Chat%20Bypass%20V2_97941654 is this a rat
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544566664010401" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4684 chrome.exe 4684 chrome.exe 2928 chrome.exe 2928 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe Token: SeShutdownPrivilege 4684 chrome.exe Token: SeCreatePagefilePrivilege 4684 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe 4684 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4684 wrote to memory of 1804 4684 chrome.exe 88 PID 4684 wrote to memory of 1804 4684 chrome.exe 88 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 4836 4684 chrome.exe 90 PID 4684 wrote to memory of 2868 4684 chrome.exe 91 PID 4684 wrote to memory of 2868 4684 chrome.exe 91 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92 PID 4684 wrote to memory of 3984 4684 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://<@711568670232543234> https://getmyfilenow.com/lp?id=Chat%20Bypass%20V2_97941654 is this a rat1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2d619758,0x7ffc2d619768,0x7ffc2d6197782⤵PID:1804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:22⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:82⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:82⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:12⤵PID:1088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:12⤵PID:1572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3984 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:12⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3496 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:12⤵PID:1208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2972 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:82⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:82⤵PID:816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4188 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:12⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2268 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:12⤵PID:748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1648 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:12⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 --field-trial-handle=1876,i,12572788823374129222,14426882247378599287,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2928
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD515f5bda7f6a9db2e8fd0ef882d79fc44
SHA1825142b0d63aceb7e25ad8a1302441f400d13ed3
SHA25667e48e602c0bcfc4aebeef8fcabdf9cb153848798a447c90968c31ae12ca4d1d
SHA512d00f7145b456316cb8fe53f27616b6a39dc381701ea295de0434bf3b7c02a67f355bf3c14d8374c4e0ed32090a894ef5d3edda9063eb73c5a626b00a3ecaeee6
-
Filesize
6KB
MD536f2ee406d514a65459af5dbfe5f7e1b
SHA1b81f8b04919f250e1c019d551117e87c9c919323
SHA25682446344da450284c6e4fd23a18b550e8fd9ef7bec2ac1d72d548b41231675e1
SHA51289f1e59c8826d802f31bc24c665fb5077d5e1cd0b5c3936784b520ccbfcdb9e6a3ff67b329dd6f1aa3e8172a77d03546310a5e7423e4c79f61f88ea982b9b146
-
Filesize
6KB
MD56c2a27db1715515f7d8c2a3ed7b5bdf4
SHA1a8a48beef20bd92f9e3360c600a1738bb715b48a
SHA25645bd0c24eb5e913f5c396949022916f055bb2b37222c3f7ae30acd8004be499f
SHA512b20e8d9e79eed9a186bbbba0c3eccd30480dc0a77eb44dd87a7387cac084477b3f6acb3d5e5df7e3970b562270052475fcfe3bf826391e0cd590f9bf2ee56151
-
Filesize
128KB
MD5dcf624a87c20784985e6a809aa5b7a44
SHA17e0b8ed647f7ba1d12bb7af87341c6b8eaf08e3a
SHA256777bd04d1ecdba1facbd2a137ee4516e7685d6172d2d04fecbc75672d668ba52
SHA5129a91920a720ec23c26f6bb09b4ffd51177b39db085443f5600a9acc0fa8726c19da53bb9faacce39ed138e3bce93cd5ac50c54f025d1c04ea1d8eada605890b2
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd