Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 10:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cpaberg.com/track/open/v2-361047511
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://cpaberg.com/track/open/v2-361047511
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133559217490261832" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4372 chrome.exe 4372 chrome.exe 60 chrome.exe 60 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4372 chrome.exe 4372 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe Token: SeShutdownPrivilege 4372 chrome.exe Token: SeCreatePagefilePrivilege 4372 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 212 4372 chrome.exe 84 PID 4372 wrote to memory of 212 4372 chrome.exe 84 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 2120 4372 chrome.exe 90 PID 4372 wrote to memory of 5116 4372 chrome.exe 91 PID 4372 wrote to memory of 5116 4372 chrome.exe 91 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92 PID 4372 wrote to memory of 4688 4372 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cpaberg.com/track/open/v2-3610475111⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa72b59758,0x7ffa72b59768,0x7ffa72b597782⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1872,i,10006014995494754772,13746916004540118155,131072 /prefetch:22⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1872,i,10006014995494754772,13746916004540118155,131072 /prefetch:82⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1232 --field-trial-handle=1872,i,10006014995494754772,13746916004540118155,131072 /prefetch:82⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1872,i,10006014995494754772,13746916004540118155,131072 /prefetch:12⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1872,i,10006014995494754772,13746916004540118155,131072 /prefetch:12⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1872,i,10006014995494754772,13746916004540118155,131072 /prefetch:82⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1872,i,10006014995494754772,13746916004540118155,131072 /prefetch:82⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1872,i,10006014995494754772,13746916004540118155,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:60
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD566eb909674545fed30ba99ac83c97c94
SHA1f100115a5cbfee70b6d3bd30617bd647609db9c4
SHA2560e2381d29bfd33a7ea6ed7e7fdb08c1b1c94d51dbf011eb29fdd18dddb8c1264
SHA51249f0910e0185ea34e6a47b7c64247be4d0d953430b2b010fcc4a5c222935e310b474b3bbc157c8bbaf776136b7c1909708223e1c2a16f8f0de7b7b7faeceb318
-
Filesize
6KB
MD5e04e3b92be55b1ef8c6c4c35efa58383
SHA1f013b66749f0abc2c2eda2c92b5d308f798c629a
SHA25691f9f5d6fa5370881ee55b055f1ad457b9b8e17b541722048aaf4be68b8d07f5
SHA512e3f97736b1bb771df00df47d8c7125dfa0a31e8d95334f0d6dda1de93f92c1f622a3a29a1352e78d236eb138fec9a28e7ad7567c656a79f1521e2039096613ba
-
Filesize
128KB
MD5b6197f765a4f105f53430d62401c0764
SHA1b8b39d21f1303f03fa6192301e880c6eb98554d6
SHA256affe724736e48cb88e16f6cd9f8e81c2e3cd7c5e38a1db10ffb38e0037653430
SHA5120b79e50f936de3ade2c5efda8b6491d4d038bf1669ab78c5618b249d8ea482d32ef33df1acb97ef16d5c60d441f18ccdd4bda0425c2d15688595dabfc993c2ef
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd