Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
24/03/2024, 23:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbEdvM2JacWNycElueGhMazlTei16UW9PYmlJQXxBQ3Jtc0treDgtLVJhNUdxbDlBXzVkdEh6a3ZNYkFKMURVVWFha3c3LUhZZk84dUg4Q1VRNFBGOHE4TUJpckxHeHRSN2xaQWhVSU5OQlNMSmNaUHBWbjU1VzBtRi1FdGdEMmZDZFAwQ2NFM0xqYWVPUVZXOHA5RQ&q=https%3A%2F%2Fbit.ly%2F3Trfb6a&stzid=UgzgSIxotTTHMiWttmF4AaABAg
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbEdvM2JacWNycElueGhMazlTei16UW9PYmlJQXxBQ3Jtc0treDgtLVJhNUdxbDlBXzVkdEh6a3ZNYkFKMURVVWFha3c3LUhZZk84dUg4Q1VRNFBGOHE4TUJpckxHeHRSN2xaQWhVSU5OQlNMSmNaUHBWbjU1VzBtRi1FdGdEMmZDZFAwQ2NFM0xqYWVPUVZXOHA5RQ&q=https%3A%2F%2Fbit.ly%2F3Trfb6a&stzid=UgzgSIxotTTHMiWttmF4AaABAg
Resource
win11-20240221-en
General
-
Target
https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbEdvM2JacWNycElueGhMazlTei16UW9PYmlJQXxBQ3Jtc0treDgtLVJhNUdxbDlBXzVkdEh6a3ZNYkFKMURVVWFha3c3LUhZZk84dUg4Q1VRNFBGOHE4TUJpckxHeHRSN2xaQWhVSU5OQlNMSmNaUHBWbjU1VzBtRi1FdGdEMmZDZFAwQ2NFM0xqYWVPUVZXOHA5RQ&q=https%3A%2F%2Fbit.ly%2F3Trfb6a&stzid=UgzgSIxotTTHMiWttmF4AaABAg
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133557949524222617" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4372 chrome.exe 4372 chrome.exe 4004 chrome.exe 4004 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4372 chrome.exe 4372 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 2580 4372 chrome.exe 76 PID 4372 wrote to memory of 2580 4372 chrome.exe 76 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 2920 4372 chrome.exe 78 PID 4372 wrote to memory of 4440 4372 chrome.exe 79 PID 4372 wrote to memory of 4440 4372 chrome.exe 79 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80 PID 4372 wrote to memory of 2272 4372 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbEdvM2JacWNycElueGhMazlTei16UW9PYmlJQXxBQ3Jtc0treDgtLVJhNUdxbDlBXzVkdEh6a3ZNYkFKMURVVWFha3c3LUhZZk84dUg4Q1VRNFBGOHE4TUJpckxHeHRSN2xaQWhVSU5OQlNMSmNaUHBWbjU1VzBtRi1FdGdEMmZDZFAwQ2NFM0xqYWVPUVZXOHA5RQ&q=https%3A%2F%2Fbit.ly%2F3Trfb6a&stzid=UgzgSIxotTTHMiWttmF4AaABAg1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff94ac29758,0x7ff94ac29768,0x7ff94ac297782⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1856,i,3321024703543647972,14680449521278965012,131072 /prefetch:22⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1856,i,3321024703543647972,14680449521278965012,131072 /prefetch:82⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1856,i,3321024703543647972,14680449521278965012,131072 /prefetch:82⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1856,i,3321024703543647972,14680449521278965012,131072 /prefetch:12⤵PID:4028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1856,i,3321024703543647972,14680449521278965012,131072 /prefetch:12⤵PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1856,i,3321024703543647972,14680449521278965012,131072 /prefetch:82⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1856,i,3321024703543647972,14680449521278965012,131072 /prefetch:82⤵PID:2468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2348 --field-trial-handle=1856,i,3321024703543647972,14680449521278965012,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4004
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c83dd179ee869aa4e63ed2ee12294b10
SHA1c45c0c2ef7b8c4d1f7f4419edb6cc0b9bd52e2dc
SHA2567c435a9d1b68cdd2903453057c9999573b1cf2bf6720f335da448da305cd4a09
SHA5128e21316d9ca11526217af82d37a1048f1cbe35ee8456b6a581af114a40c0ad7a5f55d9dc337d844907910df45df6f1eb54bf1ad6ddfe7bd6fe42e3aa5788160a
-
Filesize
1KB
MD5854a69ff777cdeda6f731ec32ada684e
SHA1ce2079667b3578985d3b65c62e3fc160b4b570a9
SHA256ade94360ea532a9179fb3310d200e6c553af0c178c5ae81d4680954364389c30
SHA512fc6f39b6c566c8ab93241c5b9b3993991071ff74611237b87cdc7effec8b0e538042760048f673e6cdcc24efd03ff59ce2d3fcb4a8760848d2bff6de06373557
-
Filesize
1KB
MD50570b2e9dc506e708a7e26c224dc2a90
SHA1c3bb615552b3a009bbc79cefb26bc7d0101e1870
SHA2563cf431f73ed967ebb5327cdd65c3777e259ecf3bc964d24d2c06466a67fea913
SHA5123cc3cafbb5576d33afb8330c327cd16695888d2d532794b6fa3240379521107a6c838f7727d8b53496a8538a20a46535b7bc17c393926b2c586c3258c02e3bba
-
Filesize
539B
MD5cc69bd7daac64ff5b8bff28a3376e33d
SHA16ccea5b9ccfcf5244c14caa85cb4681b1935586d
SHA2564e1f6c42992369d55fefdc9a5c16d936f6267e33b8beea582da4b4001aa0f7dd
SHA512168a3caf941425f451d399b4bfb61ea08bc8b462f7033e3ef5033fd2cc956b6dae2afdfbf4cf6fa2c68faec6507f5ef03ca275289cf9c4e5d57e33094b7fc049
-
Filesize
6KB
MD5a372fa11a1a3544aa37b306ce95e1a04
SHA191b4962726c52b8e3eea83cbcbfeb5d84dc6951b
SHA256fcf2903e64b197a7a4edf36b5fb43b9e0e22158d9ebdfbed2a9d5ea33436fcc2
SHA51220e68b2ef1dd7d85b59b5243f04983a1d7ba06ed9e8250b3371b2da09929866ed695992f575c39801a070563e8dd1b5c415069b9bc5f8210457d2a6795d5c1d9
-
Filesize
130KB
MD5e1090d56f49a843616088700d6d105f4
SHA1fe0233b1054afd649515f4e9896540ad9cca200b
SHA256467ef44e5fa0c735646a5504ecbf94dfa357eaa9018179f1eb404db1b34d9b1d
SHA5123c8160dfbc7f7a9f41d5793387e7a76f90550aab268aa891934c5876d209c720c7076b91355902cc739e31d39c341433b3790c4c60082e2b22837b7e3c166fef
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd