Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 19:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://bamboo.cicd.ldc.rbcits.com
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://bamboo.cicd.ldc.rbcits.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133548313660573487" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4944 chrome.exe 4944 chrome.exe 1576 chrome.exe 1576 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4920 4944 chrome.exe 89 PID 4944 wrote to memory of 4920 4944 chrome.exe 89 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1692 4944 chrome.exe 92 PID 4944 wrote to memory of 1728 4944 chrome.exe 93 PID 4944 wrote to memory of 1728 4944 chrome.exe 93 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94 PID 4944 wrote to memory of 4940 4944 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bamboo.cicd.ldc.rbcits.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffdf6409758,0x7ffdf6409768,0x7ffdf64097782⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:22⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:82⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:82⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:12⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:12⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3676 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:12⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2980 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:12⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:82⤵PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:82⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4536 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:12⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3676 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:12⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4972 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:12⤵PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2820 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=832 --field-trial-handle=1884,i,3358850054564193083,3414217093018247363,131072 /prefetch:12⤵PID:516
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51627d3024ec4358f69598fcd9d73a31e
SHA1769a5fc23f3d833316f97eaa3f52ec6ce5e43117
SHA256aa5aba01423740c81e1e716318ee34feb89d603479643cd8f0a1e8806f13b369
SHA512d4caa662c068450ed434e787ac15a40e67dadaf6599e470fb364c4176d1d32a34ff68e89cfbfd7f07d8f47e63598901e81ce8a1f08b214433d264e2459cafc48
-
Filesize
6KB
MD54dd781f093ff3c249606823053927dc8
SHA16100c642cbedbf226eab7c01fac9ef576c4a1227
SHA2562295b5b2dfca555149867d7374703fb6b6bf3236f5257a9d390f3bdf1cec521b
SHA512e9971ecc0f636fc955a73b0b4f3b22340d2b93185859874639c2b179f786e5798828118f26f8e1bc8099281b4af650185baba78aa45e20b5f5f0c5c488efdb0e
-
Filesize
6KB
MD5812d479f751a3d7a2bdcf3da9fc5fd97
SHA13b0d8e4905b849388d5a80facc7c5e9fca469873
SHA256349871c9c022642098cc8036b07bee3debec35a3863569f0b0b6ada8d9ff3125
SHA512e395b57cf7848e1f6b3aa79fb31d42c9c2ddc2b079222420b4e56f4d71376ab4fd0f2213cee9df1cb335278c20d67bd4826a498e20cda378df8937a3671e032a
-
Filesize
128KB
MD5fc09ea7e62fe229df0e1a3cdb175c9de
SHA10e6dc2db5cd39372d03e59bc0387d17783c89b92
SHA2564df83e211b9b5e4c75a9481bd1afb240e328b0cae3411007dfb6961b92aba46f
SHA51228c436bd250c202ab24eaab1f96861e4a957c66df1e30994561bec3c384f647bb95848671632f19e467e1d18973231193d520b35a33d61122ca2f2ea00ba199f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd