Analysis
-
max time kernel
75s -
max time network
81s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 16:55
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
Processes:
flow ioc 40 https://ring.com/users/sign_in -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133553410099709030" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2956 chrome.exe 2956 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe Token: SeShutdownPrivilege 2956 chrome.exe Token: SeCreatePagefilePrivilege 2956 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe 2956 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2956 wrote to memory of 1020 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 1020 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4700 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 5076 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 5076 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe PID 2956 wrote to memory of 4088 2956 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docvmentdrive.au1.cdn-alpha.com/sgdrive/invoice-10780.pdf1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd61699758,0x7ffd61699768,0x7ffd616997782⤵PID:1020
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1908,i,10823167219661819014,2994530407052291187,131072 /prefetch:22⤵PID:4700
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1908,i,10823167219661819014,2994530407052291187,131072 /prefetch:82⤵PID:5076
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,10823167219661819014,2994530407052291187,131072 /prefetch:82⤵PID:4088
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1908,i,10823167219661819014,2994530407052291187,131072 /prefetch:12⤵PID:2192
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1908,i,10823167219661819014,2994530407052291187,131072 /prefetch:12⤵PID:5100
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4664 --field-trial-handle=1908,i,10823167219661819014,2994530407052291187,131072 /prefetch:12⤵PID:3556
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4024 --field-trial-handle=1908,i,10823167219661819014,2994530407052291187,131072 /prefetch:12⤵PID:3852
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1908,i,10823167219661819014,2994530407052291187,131072 /prefetch:82⤵PID:4084
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 --field-trial-handle=1908,i,10823167219661819014,2994530407052291187,131072 /prefetch:82⤵PID:1112
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
120B
MD5751f5aa6e482c8fcda8d473cff4ec788
SHA18fbf126a9131d29a9abeaeb5fec736b1ded5d7de
SHA256aa4c5ed85ce7a2ab196df0cb15211fcb312e69e54e34bfea51f6df9ad2796fbb
SHA5123865ca52f5e42ab32f1bbdedb2525f80df40a3e67f6171b696cdefcf0490e751471d05354207eb6238303a3b351796ab6765490ec98ec7348281c679c83430fd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5906d2d6d1e4a47f3b7b0867a6dc4c8ef
SHA15df7baf896427b7e9fc6248029e04d1fc31cf297
SHA2564fa30c253ed80f5a7fcdc8a4c7a10e04b91c36673c4ec3c55c408197671be070
SHA512312b52f7277c05c8a22de28d2567c665bbfcf4d2185b9f2f6380912364882397b344a5970cea5c8a59e1b0c4724a6032d357d219bd03bcb7bc6373d66308970b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5f7fba42e17b9d84b26d1b70b349050c0
SHA1b95cbfd6fe068bd79c0094e50a2574927f44a3af
SHA2566e8328aa09167e39e460ca7067e690c2275e0120b0208218dae2e2d4a2d0f559
SHA512d00594c19e089f3fa649b61fcda82fe1bea4ded9af197336de469f0ee1d0382ab18fa313e916d58ac303b43686907862407e548941ed61cce1ae47b42c2e890d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5c9a504874b0e753f2d457b8dcac27e34
SHA1f4295f4a7e66dc17822703556b5fde934d8ec053
SHA2565de0da7a95089b816e9608b4bcf0a31c7907350791beedce1b4d00afbef32d91
SHA512311df5f8a2336443d3eb093c8028b13b40ed9bc8cd842e4dbba9911161cc83e4d0c15ffb030f4a93b5a865b4b3624be4043c3152c75aac2467e4fa0c47f3bba2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
128KB
MD50425b30ee5dcff863b2bbdbc7c695ed6
SHA104688da3c74148fbd290005c1644ac40b23fed1b
SHA2568dc5724c91db7b6d03555764e84fcd2cd8c05512a013df024f3dd6ecb41a7829
SHA51266e3752af2254546b6f9ed08776dee074e5001e9f9801b2ce5d0c6122bcc9bae2b0b01663e47adae27913735a47a40fb8256a22320d7649a18ae5e6ee133dbed
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_2956_TWXNWOHWYVMXQWRDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e