Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2024 01:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://e.glgbroadcast.com/glgrouplz/lz.aspx?p1=MTIDU4NzE5MjJTNDkxNToyNzcyQTQxQzBDRTUxRUQ5N0M3OUU3NDhDRThDQzczOA==-&CC=&w=https://klask?co.uk/css#7987anVzdGluLndpbGxpYW1zQHZvbHZvLmNvbQ==??WERKERTI=anVzdGluLndpbGxpYW1zQHZvbHZvLmNvbQ==/..=KINTIKIM&u=276b8dda4ef94158348d5b6b8&id=6b7205781d
Resource
win10v2004-20240226-en
General
-
Target
https://e.glgbroadcast.com/glgrouplz/lz.aspx?p1=MTIDU4NzE5MjJTNDkxNToyNzcyQTQxQzBDRTUxRUQ5N0M3OUU3NDhDRThDQzczOA==-&CC=&w=https://klask?co.uk/css#7987anVzdGluLndpbGxpYW1zQHZvbHZvLmNvbQ==??WERKERTI=anVzdGluLndpbGxpYW1zQHZvbHZvLmNvbQ==/..=KINTIKIM&u=276b8dda4ef94158348d5b6b8&id=6b7205781d
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133550260857128578" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 932 chrome.exe 932 chrome.exe 3484 chrome.exe 3484 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 932 wrote to memory of 1036 932 chrome.exe 89 PID 932 wrote to memory of 1036 932 chrome.exe 89 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 2844 932 chrome.exe 92 PID 932 wrote to memory of 1500 932 chrome.exe 93 PID 932 wrote to memory of 1500 932 chrome.exe 93 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94 PID 932 wrote to memory of 3804 932 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://e.glgbroadcast.com/glgrouplz/lz.aspx?p1=MTIDU4NzE5MjJTNDkxNToyNzcyQTQxQzBDRTUxRUQ5N0M3OUU3NDhDRThDQzczOA==-&CC=&w=https://klask?co.uk/css#7987anVzdGluLndpbGxpYW1zQHZvbHZvLmNvbQ==??WERKERTI=anVzdGluLndpbGxpYW1zQHZvbHZvLmNvbQ==/..=KINTIKIM&u=276b8dda4ef94158348d5b6b8&id=6b7205781d1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa35629758,0x7ffa35629768,0x7ffa356297782⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:22⤵PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:82⤵PID:1500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:82⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:12⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:12⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4732 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:12⤵PID:3500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4852 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:12⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:82⤵PID:228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:82⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3848 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:12⤵PID:1232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2168 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:12⤵PID:740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4892 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:12⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 --field-trial-handle=1836,i,6282555760596738658,15144645032548481942,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD556c0f4739131196e0233bb9bfe202c4c
SHA1bfa20f43c5c31ee0dd1cf754b0e2ea0483351013
SHA256856759c9b1f49bb91b086576c980f6d4be1f00664d2d3c0de90b0ea580486b5f
SHA51299e9156bf80829c234ac1af684382b8536ea65001fd326f828d48d96ad256866be4fcc281877c8aad6792020c557ab1434f3b110854a7f69accf677e4fbd5f4b
-
Filesize
539B
MD5ee6847f45bd9a42e46fa540357e7bb83
SHA1080fd3dbfb16f970f3032e1710159f2e57c6a0d4
SHA25680024ea7c67d5c3fa3f03589b6f59dc37f4c05694ac450c7777934f3e340a233
SHA512e60369e4a8b89b151561f7678c2ba18a8e5ad85595bb1fd10f2af4c50df90a64f56f89c4d5ddc560d396f8a445ca2f4ba524990be464e85bc7fcfc005d162ebb
-
Filesize
6KB
MD597ae976bfc492dd80b87dfbd4d6ddc59
SHA1b07c30a8b434b791bdcea8b8c5e2954ed923d1dc
SHA256451f3eff3e69af346804295b80fdabf0eb2c0ee11399a8732136e54f10706dc2
SHA51270601fb4144ce08231af4fe066234c39d20b16c0e8c13a9eb4e923adaa06475b08cfc5e7d19ef42a8b660a2c6d933f27a593719838bc75378a1b7542a46c308c
-
Filesize
6KB
MD54ff0878a1a08196a0b93460810feb107
SHA1cfb716d8d0568452caa51ba09cf500531390f543
SHA25685959198eb1fb97b66b428ee7431e31aa416711c1ce3943519c7c060104474a5
SHA512ad1f82ddc749f2a48d64631f6852f5ecca07b138ae6bebceb18365ccdbb6eb370e6f8ae5550f5abeef269e29970eecd1626fc6f765d360df19e9f50ec44e0017
-
Filesize
128KB
MD5bccdbd6ddd2e4d6a3a7cddbd0503f781
SHA1d25adc1f1be75abc48f49effbf58765985265c93
SHA2568404fc5a9371e6bf8e4315eb2fa9b09f1ed08c9c164c0260ae9654a82d1c304e
SHA5129cea44b9a25ad41f0c33ba0268b89d8d6925386ef325d78a5909cfa8abd50c1242f7496e5c6adad60e9eb0346156fd0ee37a2dcb939f5a71d9a3441cb3cb5f71
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd