Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-03-2024 16:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://4616839.app.netsuite.com/"></head><body style="font-family:Verdana,Arial,Helvetica,sans-serif; font-size:10pt
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://4616839.app.netsuite.com/"></head><body style="font-family:Verdana,Arial,Helvetica,sans-serif; font-size:10pt
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133552547616161137" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4820 chrome.exe 4820 chrome.exe 396 chrome.exe 396 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4820 chrome.exe 4820 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4820 wrote to memory of 4764 4820 chrome.exe 90 PID 4820 wrote to memory of 4764 4820 chrome.exe 90 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 4572 4820 chrome.exe 92 PID 4820 wrote to memory of 2128 4820 chrome.exe 93 PID 4820 wrote to memory of 2128 4820 chrome.exe 93 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94 PID 4820 wrote to memory of 3604 4820 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://4616839.app.netsuite.com/"></head><body style="font-family:Verdana,Arial,Helvetica,sans-serif; font-size:10pt1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfdcf9758,0x7ffbfdcf9768,0x7ffbfdcf97782⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1876,i,7864502419978642977,15577308636292257411,131072 /prefetch:22⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1876,i,7864502419978642977,15577308636292257411,131072 /prefetch:82⤵PID:2128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1876,i,7864502419978642977,15577308636292257411,131072 /prefetch:82⤵PID:3604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1876,i,7864502419978642977,15577308636292257411,131072 /prefetch:12⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1876,i,7864502419978642977,15577308636292257411,131072 /prefetch:12⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1876,i,7864502419978642977,15577308636292257411,131072 /prefetch:82⤵PID:4016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1876,i,7864502419978642977,15577308636292257411,131072 /prefetch:82⤵PID:3976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1876,i,7864502419978642977,15577308636292257411,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:396
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ad1ac52ee68e0e0c6cf293f64517381f
SHA1769daf0a6cc07666c2bf6602591779b20131f95d
SHA2566e95f0c56fa8b6256c223289c0a065d125ddbca3a2b908400188aef621ddbb15
SHA5124216bfc11559f21fe3c9ded6d629fb80ed7ff6765f1fa2a6a3aae07c71b7b38a0803053f0f67b11548e4cb550bc883f6a1e8e679b60450650efc55d5cf03945a
-
Filesize
539B
MD552ec54781bdf04ad22aa969946e9225f
SHA1adbcc4f9206ab5abe878da08dd1338b15bf9d3c0
SHA256a77ac90c5341c8ebdf58fa55681507bdb2294e2d98de5ee9e5155d7e89ccf1dd
SHA51270ddb63c2b2ae9d97b3c9d6c5efbcf49e3496cd2ae961af843fa3e6970e1400284fca02c2874c0bf4632a60ceb315095a3ffa9bd2361b2a962f488377aa9dbb3
-
Filesize
6KB
MD5ff30d4c3dc3bdd210b01adcd298d7505
SHA163f841206da15f17f1f470ff7328193ce44d4e54
SHA256ad608a584652bc3f18960bdc44c454c6402b256978b8a346f763c0d09f0be5bc
SHA5124a1382a34a29b046c8900e15f44f29f3f41d54b789902745eb62bd441f10d093a12a61b7d184e6e02c850329347773e64981492a9e4642e710182d071bbd4a26
-
Filesize
253KB
MD5f685cc568ae4e21435b8a581e03148d8
SHA17627b4d2d4ac95b2acacca2ad32d8564290347d1
SHA2560300c86977f03f2cea760203be590453242d19de6c999d3de8eaaf72215a5b99
SHA512b281c4812d221b7cfeafc00d7aaff2d538bed8d3048d670d79e252b34df941942ada33ee5332b43791a74d6a661ecf014cefd8601378487a8df9813103f00a9c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd