Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-es -
resource tags
arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
12/03/2024, 14:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://u9584.birdsend.net/c/_b8562ae2b292b881acb7b8d3fd24/39299483/350744/9b2cb637c235db553dc80e46722e7c94/?ms=50
Resource
win10v2004-20240226-es
General
-
Target
https://u9584.birdsend.net/c/_b8562ae2b292b881acb7b8d3fd24/39299483/350744/9b2cb637c235db553dc80e46722e7c94/?ms=50
Malware Config
Signatures
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 44.228.224.62 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133547260558352443" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe 3336 chrome.exe 3336 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4020 wrote to memory of 4632 4020 chrome.exe 86 PID 4020 wrote to memory of 4632 4020 chrome.exe 86 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4068 4020 chrome.exe 88 PID 4020 wrote to memory of 4328 4020 chrome.exe 89 PID 4020 wrote to memory of 4328 4020 chrome.exe 89 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90 PID 4020 wrote to memory of 4564 4020 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u9584.birdsend.net/c/_b8562ae2b292b881acb7b8d3fd24/39299483/350744/9b2cb637c235db553dc80e46722e7c94/?ms=501⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd186c9758,0x7ffd186c9768,0x7ffd186c97782⤵PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:22⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:82⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:82⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:12⤵PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:12⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:82⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:82⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5696 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:12⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3120 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:12⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4660 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:12⤵PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=6064 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:12⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1900,i,4190636694915743143,15763960071926285035,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3336
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336B
MD58f09695db3558b5ea5e48fd10d0c298b
SHA1d708bba3164e3c40e7fb70411d3932a20aa0f060
SHA2569233f556f5347faaed5b80d1a400f4140df296f31539c9b866e1333381af1170
SHA5120eaa20b2f70b13456c2a770058daf2adf781cef853d1447e98c562c60ca40bd20d23a7f6da8f4bbe70c105a6a4014f3ba2a85f4e0216177afc5b50124b8defa7
-
Filesize
3KB
MD5638c4b542d7c7f9654fb809ec5c94c4f
SHA111e168106ad164615ca237707a28dd9793120785
SHA256c43282eb4cc8fe112ca5e5bcf3b2d5fcfc911eecb2f3b094bba281a0650602c8
SHA5125fc4d9c7bcf6d0899aff9ee46030c75936d59cd838c1d4933d5a52046304e8d6382d06bf81107f8ad26c070880b23771f71fe160834c4e4bdcde0dcd6832a6d9
-
Filesize
2KB
MD51a9a3043423f720c769cb33ed6aa1c7e
SHA110cba0daa995fb2149f4ca44c0852ff906849304
SHA256dfe9731be900b00670d65ab357a85878d08fad254d9bcc811553ca17f314d1d9
SHA512f0ca64d1ed57086456c8cd16502a9d412548c6a5035bc40899b02fefed496f5fbf094f14efc2642a0bd19971bef856356bdcdba7530c137906ef894d6eba4cb1
-
Filesize
539B
MD5c12699a92de1906724c265fa7e0057ba
SHA1c10a4bf99f75978294e48bd07e23ecbfc48a89ef
SHA25622eaf89f2cf5707931578267621f522c909a873d07b499a63d3fd9f87806d9c4
SHA5128720c0da99784fa928886d5c6e24a4ebf0befdbfaab2c2a31f149620a81fc22a02a482be0903c8c8856be6a3d957d012c4914ff92975c88efc3413ce4eff0a87
-
Filesize
6KB
MD5e592a5b81cb89c4de786e6fb6da753d0
SHA16c9c77e698787ceeb8c9f719aa5e83337b11e2d2
SHA256182187bf411c2a22c00ca1965a622bcd9b4348087174069eedbc91828b9c2032
SHA51224dde765be34d31c79168966b1c0b99c2b6f43a71e0d1b003a6a92b9eb86fcf99ed275c005d2792e444f47e0486a52b26cff0e5d5ad749ec72219573516c505f
-
Filesize
6KB
MD553b48d4c9c0cd3b054a39ffdbd0ce2c1
SHA1af1a010a1b48f68fcde7a3dba9ffce8aa1cf31f7
SHA25686bb05230052725cce08785dd5239ee0c360c912cb75145f31138543f7458a32
SHA512fa273ebf2feec533cb9bdfe72760c122631094c8f39f995134c5cab23085f99a72e01f14b49293e0cb50dd15d40b0eea6e0e545ae27a62799d2398e00035cdac
-
Filesize
128KB
MD5989f3120c90c5c963cb9e44022bef8af
SHA19c86b4a740a84bf51a9d6d2e3bb772c72f1c2044
SHA2561490f004dabad3eb843c7e62f54dd801068a55c498a79d135b2a50450a6e1697
SHA512b84544d1081c2e420033e0bcde7f0022a805ea3b5a6097ee378731d8fa8acb31d32bf20c6c3414fb2aea28062b301eb824d7b2ddc9a0a49f4e43ac5db6d8feb4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd