Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-03-2024 17:25
Static task
static1
Behavioral task
behavioral1
Sample
7058ec4a666c1eaf2d98881b61.html
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
7058ec4a666c1eaf2d98881b61.html
-
Size
289B
-
MD5
45ac9deca88de47dc082d97a5c25df62
-
SHA1
b60e853d65349ec0e6f397f2ced2f1ca19da16e7
-
SHA256
eee00d8ba305543be6af21634bc2959f0c266033016253a074eca3cbe39e1c87
-
SHA512
e1994abe202f1a5c4e14717329b0d20dad05d2b75ca2715d13a08258dba7cde7ee257419bc4876dc1304b43fc28de1bf8291353d1fb374b2630116f6f377281f
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544787395764821" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1884 chrome.exe 1884 chrome.exe 2116 chrome.exe 2116 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1884 chrome.exe 1884 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe Token: SeShutdownPrivilege 1884 chrome.exe Token: SeCreatePagefilePrivilege 1884 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe 1884 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 1556 1884 chrome.exe 86 PID 1884 wrote to memory of 1556 1884 chrome.exe 86 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 1204 1884 chrome.exe 89 PID 1884 wrote to memory of 3476 1884 chrome.exe 90 PID 1884 wrote to memory of 3476 1884 chrome.exe 90 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91 PID 1884 wrote to memory of 2972 1884 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\7058ec4a666c1eaf2d98881b61.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffdf5299758,0x7ffdf5299768,0x7ffdf52997782⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1924,i,5892515864336906217,11715184942301207972,131072 /prefetch:22⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1924,i,5892515864336906217,11715184942301207972,131072 /prefetch:82⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1924,i,5892515864336906217,11715184942301207972,131072 /prefetch:82⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1924,i,5892515864336906217,11715184942301207972,131072 /prefetch:12⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1924,i,5892515864336906217,11715184942301207972,131072 /prefetch:12⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1924,i,5892515864336906217,11715184942301207972,131072 /prefetch:82⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1924,i,5892515864336906217,11715184942301207972,131072 /prefetch:82⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1924,i,5892515864336906217,11715184942301207972,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2116
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5766b57dfa9599319e61352612d5b804f
SHA162f28f3fd8447468ca38b76708a8f6ead4c9ec5f
SHA25653d0738212d9b531b5e6803fcb9279200c6d877ae8b28a828d660211bfbe83a3
SHA5124b271b94e59d83e8c00fcc0209b1f432a34d6b0fae89051fb50ba8ca1308dea8dff0e963a9247bee50afbb5b6eafe4578bfa50af792b10e0cd441a3fe2013778
-
Filesize
6KB
MD55fba98a715593f63922bb3a78605074b
SHA13d0264ab388502a80d9cc5df301c6ddd35c3313e
SHA2560ff9f62ce937f8274536f689d486581d0a8d7b70acb96739339a42ec625f991c
SHA5122577b3ed11f35fa5d9482ebc221e434844bb4122feb4623324b004ae24f18ac86047dbec5b5e1e84f0d212c516bebb7f1f8454f153e6c3721f38ee4565c216c8
-
Filesize
128KB
MD59d76d58eebcad512000490168284fb81
SHA13e412a2ff08d85669902ba19c0a1cae3465cfed3
SHA256161bfaf96f3f4102a61869a3ead0cfd500ba798d7b1af4e7e401cb1a93ecb6dc
SHA51241665e49bfcc2aa98023eba87037ed38e0ecd6a8c59e217e1703e1b642da12fc77e107b229ad755cea76b4739ebc0bc331b9e3677dcdcd426fe28ad107c49717
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd