Analysis
-
max time kernel
600s -
max time network
513s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
redirect.html
Resource
win7-20240221-en
windows7-x64
6 signatures
600 seconds
Behavioral task
behavioral2
Sample
redirect.html
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
redirect.html
-
Size
6KB
-
MD5
5df528273a25404f464812c9e1cdf2f9
-
SHA1
8aa97d9ce57d0d4a46cffe2f0ccc585da060b2b0
-
SHA256
9bc6c9656ca3e8191cca486b500962f1dda37211707c7b02341f4ddaad272b3e
-
SHA512
0e8f61bf60a976ff859448fa0844bf5fb3514cbc125522dd14a21e5db16c70d28c314a42d90783db0f953a764efaf10a57f184f4e57f885a3917f00358431bef
-
SSDEEP
192:dLHLxX7777/77QF7lyrJ0Lod4BYCIpoOaXQw:dLr5HY+0+CIpoOaXx
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133545813002376684" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 448 chrome.exe 448 chrome.exe 2044 chrome.exe 2044 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 448 chrome.exe 448 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 448 wrote to memory of 3140 448 chrome.exe 88 PID 448 wrote to memory of 3140 448 chrome.exe 88 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 2780 448 chrome.exe 91 PID 448 wrote to memory of 3736 448 chrome.exe 92 PID 448 wrote to memory of 3736 448 chrome.exe 92 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93 PID 448 wrote to memory of 1280 448 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\redirect.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa122e9758,0x7ffa122e9768,0x7ffa122e97782⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1844,i,14463911607812721504,15802106038691952078,131072 /prefetch:22⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1844,i,14463911607812721504,15802106038691952078,131072 /prefetch:82⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1844,i,14463911607812721504,15802106038691952078,131072 /prefetch:82⤵PID:1280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1844,i,14463911607812721504,15802106038691952078,131072 /prefetch:12⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1844,i,14463911607812721504,15802106038691952078,131072 /prefetch:12⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1844,i,14463911607812721504,15802106038691952078,131072 /prefetch:82⤵PID:2660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1844,i,14463911607812721504,15802106038691952078,131072 /prefetch:82⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4628 --field-trial-handle=1844,i,14463911607812721504,15802106038691952078,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51dbec999cfa4279992174084ce238111
SHA1fe6f0b35fa67c369dda7123940ca113d9d7081dd
SHA256d7cc7178cb2565e89da2848faf232d37d23d7000d01748a332da49e75dfe9aba
SHA5129e7e9f183fb8c4f96638b6a27749f777668d030644536a9ae0ec5e7052ff2571c55f83a6bee22426263ffb38d1b7bf050efc680e3656e6fe0a38a1af79f71ca7
-
Filesize
6KB
MD5f1d329347c7a8036928e7247a758fd8f
SHA1dd699ee997123c350c8fc5fc9981e3686a40e603
SHA2565fe3aa88798716ad52a65c3604e1403b7109d38fc2d352050d33544d54400ee5
SHA512acc708560a8a057c65b4efbcd1017495eb0d568d1e3b11849281bf943caea2dd1f82f1501e03a877a7c34506f73051cb566911ae133369236b2f504137cea8ca
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f1d692ba-ba59-4fbd-a1d2-0c41d3fbc4bd.tmp
Filesize6KB
MD5b5d33d58f766b749605b41450b02a1ad
SHA1e23b1d71a6320121aa200fb203977f84f0008559
SHA2565646f6e1ce1c8f7533a0852eb63c45bc3b58d1393183a2fdf2f53b2d1afe0af0
SHA512c935f77883447fa9b4f6423078ee9f8be47faab74a0b6f7d5741a6a6a1b860e382a282615d24e1ef5a77aba72b14e22fd61cad4e460ebdc074e417d209888f3d
-
Filesize
128KB
MD5f6fcd89fcf444db0375e06c462d5ff5f
SHA154db704573306894c291d34fdd95b2714afdaa44
SHA2563cba1eec1dc5962153ac9dbfe31ff38f757a10126b8fa1d9dbbc94efa99db68a
SHA51218cbdbd35f5fccfb42990189a809f4251506b8470194ea2ff98229edf6a802da237a4a9c222278dc5ae8035ce30910b4a78187cee391b4d0fb4fddb8baf35ee0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd