Analysis
-
max time kernel
614s -
max time network
504s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 20:12
Static task
static1
Behavioral task
behavioral1
Sample
k5bkjhOtWReD01jYUs35VZgvAtlnZtkRMZ6VjJHK.html
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
k5bkjhOtWReD01jYUs35VZgvAtlnZtkRMZ6VjJHK.html
-
Size
146B
-
MD5
9fe3cb2b7313dc79bb477bc8fde184a7
-
SHA1
4d7b3cb41e90618358d0ee066c45c76227a13747
-
SHA256
32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864
-
SHA512
c54ad4f5292784e50b4830a8210b0d4d4ee08b803f4975c9859e637d483b3af38cb0436ac501dea0c73867b1a2c41b39ef2c27dc3fb20f3f27519b719ea743db
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133548418664933899" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe 2792 chrome.exe 2792 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1064 wrote to memory of 2756 1064 chrome.exe 89 PID 1064 wrote to memory of 2756 1064 chrome.exe 89 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 3564 1064 chrome.exe 91 PID 1064 wrote to memory of 4076 1064 chrome.exe 92 PID 1064 wrote to memory of 4076 1064 chrome.exe 92 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93 PID 1064 wrote to memory of 4284 1064 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\k5bkjhOtWReD01jYUs35VZgvAtlnZtkRMZ6VjJHK.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3d6d9758,0x7fff3d6d9768,0x7fff3d6d97782⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1868,i,4648242615837584475,12111284994291651217,131072 /prefetch:22⤵PID:3564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1868,i,4648242615837584475,12111284994291651217,131072 /prefetch:82⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2148 --field-trial-handle=1868,i,4648242615837584475,12111284994291651217,131072 /prefetch:82⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1868,i,4648242615837584475,12111284994291651217,131072 /prefetch:12⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1868,i,4648242615837584475,12111284994291651217,131072 /prefetch:12⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 --field-trial-handle=1868,i,4648242615837584475,12111284994291651217,131072 /prefetch:82⤵PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1868,i,4648242615837584475,12111284994291651217,131072 /prefetch:82⤵PID:448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3716 --field-trial-handle=1868,i,4648242615837584475,12111284994291651217,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2792
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51a8f6900ec064c7cdf0921a682e1a0e3
SHA1173bc424da5b4763579e935bab63dca530c7bf91
SHA256ece9065c4eed43f853a4bc050219577e77758eef50cbe422716ad35a0195f5ba
SHA512e6a5d525ed5842618fa712c4dc7d5f1f357fd2c44d774392cdfb31966d7bdcf4cc580b9aa913476045c315061cbde36dd5f39cf81fbd2b386807b0336caeeebf
-
Filesize
6KB
MD544ecc31e5ab75a779b205670a5615f9f
SHA1642e0efd626d45ace9d3df320be80acdbdf2b65b
SHA25607bae90e97223ece4e7f1f9bc72f4c0eb1e76a09e53ffc18a3ef33d2718bcaf3
SHA51292bcc73e2da46a56d317bdf1a9aa6dbaea51cbcc84eac2c05d74743bc546e161e766b21ce52f243ff2773169afc7ece4ae50f732543cde13044e4ae2d0093443
-
Filesize
6KB
MD546d09470b5d36aab9581a1e27299d357
SHA1c90bbf7a62bfcdb832d73aaa7ab0d9a1fbe9c825
SHA2562c8b2570eb4d77287800ca35d5b8ce2dd4fceb8ee5eb3360d25cbe566905717a
SHA512a970eeb1e30f1c72edf22371353b32a5ba663725b259e61d063d095164a553fe7cf807f17f46f02a7d702689f690f883eea0418f2a8d0bb6ca5cc7d15864960b
-
Filesize
128KB
MD5019eb402c4275d3f3bbc270fa0dc73e9
SHA125c7d99bc892e4d7c5ac617a4d1304a548ee8d52
SHA256e9f0c4a07f46a467bc61b09bee6f74d95ed5156acb32fa3f89b2165c5f58374f
SHA512912891f7cc3ecd5550197b4e1ff03990ee85d80446af9bc59ceceb21ce9e198f46330abf2f4af954e28ac3b5270ec91ef84c46177c3b307499b4554946e5672c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd