Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 12:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://shopmastxz.fr-1.paas.massivegrid.net/
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://shopmastxz.fr-1.paas.massivegrid.net/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133548931581251591" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4840 chrome.exe 4840 chrome.exe 5784 chrome.exe 5784 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4840 chrome.exe 4840 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe Token: SeShutdownPrivilege 4840 chrome.exe Token: SeCreatePagefilePrivilege 4840 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe 4840 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 760 4840 chrome.exe 87 PID 4840 wrote to memory of 760 4840 chrome.exe 87 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1828 4840 chrome.exe 89 PID 4840 wrote to memory of 1616 4840 chrome.exe 90 PID 4840 wrote to memory of 1616 4840 chrome.exe 90 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91 PID 4840 wrote to memory of 740 4840 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shopmastxz.fr-1.paas.massivegrid.net/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff813189758,0x7ff813189768,0x7ff8131897782⤵PID:760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1832,i,2179249832310601126,16558633915802603237,131072 /prefetch:22⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1832,i,2179249832310601126,16558633915802603237,131072 /prefetch:82⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1832,i,2179249832310601126,16558633915802603237,131072 /prefetch:82⤵PID:740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1832,i,2179249832310601126,16558633915802603237,131072 /prefetch:12⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1832,i,2179249832310601126,16558633915802603237,131072 /prefetch:12⤵PID:1216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 --field-trial-handle=1832,i,2179249832310601126,16558633915802603237,131072 /prefetch:82⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1832,i,2179249832310601126,16558633915802603237,131072 /prefetch:82⤵PID:3748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2684 --field-trial-handle=1832,i,2179249832310601126,16558633915802603237,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5784
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b440ef31e583f8995821b5b291662965
SHA128bc0181d5fd87113c0770a72de2cecfdd39e653
SHA2565bc9264f72553b92f52339b73d9c36e852df4d5d88554510cccdd83c85eea9e8
SHA512c6a0e4b463a50ecd349bcc5e53684ca55aa5bc7d64cb29582f5062067c508d901de29d993e1bb1802aee6975e0d16f53d038d7345022d707c972ba2d54bc8a38
-
Filesize
539B
MD516fa3ed3a7ded186b2487f7210fa7d1b
SHA18a831482e793c7861eede6c577afac2d893e81b0
SHA2561c99a4f8aafcb318fb657dafa8a3c4fd69107b64363741d41467ca8b07cb21c6
SHA512f592dcdadca792725024a577404eec478f94b0261f0e2bc61c022f33d5e36fa4abb18f5a1c3f4c7f4d8be33ad48acc02ce5df2fcc01f3383c50030e3618fb886
-
Filesize
6KB
MD5c367be42e520750770b27275bce149ba
SHA1d69dc3316e81f39781ebe32e9a772fa6237ceda0
SHA256026f5c123da9439a73717c69e6d8025c762a412a40ba30e71e05187af979bc1e
SHA512f10c5ae0d8ea76ef65e71309e358e5a5fbe09faeb156b44a91d53bd250e60a7cfc61e4a2d763be79be27531b633b76052c0b0f762cb78cc4463b2a2de2c717ff
-
Filesize
128KB
MD5dd1d138e5dea3886ae90c7257bb22e98
SHA119d73b1318307a65324d65a3f3e31b0b85e96f13
SHA2566c71bf641f6f73fe83d4de895ebf378b77432a0559007c4df9fdbe23b09d8cb9
SHA5125165c1d902d53ade546c0d3c37ed26d7a874d05a655ae18afface1b72cddf8d43999efe9d7408d9b57bf49b47f997c54d48ebf066c79a20fb97c7da4e9d3968a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd