Analysis
-
max time kernel
41s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 02:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://kizeimieveingo.shop/?uk8pp605&oc9ewtnr&tggdown
Resource
win10v2004-20240226-en
General
-
Target
https://kizeimieveingo.shop/?uk8pp605&oc9ewtnr&tggdown
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133559811153248338" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4604 chrome.exe 4604 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 4604 chrome.exe 4604 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe Token: SeShutdownPrivilege 4604 chrome.exe Token: SeCreatePagefilePrivilege 4604 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe 4604 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4604 wrote to memory of 4952 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4952 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 5064 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4764 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4764 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe PID 4604 wrote to memory of 4688 4604 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kizeimieveingo.shop/?uk8pp605&oc9ewtnr&tggdown1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff01a39758,0x7fff01a39768,0x7fff01a397782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1644,i,13213109769688470720,11981055808460597718,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1644,i,13213109769688470720,11981055808460597718,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1644,i,13213109769688470720,11981055808460597718,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1644,i,13213109769688470720,11981055808460597718,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1644,i,13213109769688470720,11981055808460597718,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1644,i,13213109769688470720,11981055808460597718,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1644,i,13213109769688470720,11981055808460597718,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
120B
MD54ab9ea1a14a0cb020d1a4be84f259be4
SHA1685baa240db29a06ce60ad0a3e67258bf059886d
SHA2563551b4e04d6222e15fd2751214bbf10e220e1b54747b17f903926446df0667a5
SHA512d09c2dba0a94a8e3ecbfdc4e42c5727bda8786660fc15355cd1c597ec3bef2a2119d1a550f7dbca6d1c4945f85c8caaac47c3d1b21d342aa5c21f085a65543e7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
538B
MD5e982216c77ca080fd2dfca03475d33e8
SHA1357206e6fc90499714868cf672060c50131dcb50
SHA256ccf76d8ca53c698e63cc8dc0b5bf6ff68083e6cb21adfb5ba92e275bd1e88b2b
SHA512b87339684328d0272eb420ca98688ba5a1a51eac7c530e584ed047b4391cb8d33bde30c81dcdbab84aa87de42d1d066dbd964961bc0104aa2a06f2b84a2808da
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5b01f6c3d9d23df374c6657f8827be944
SHA1253013f37b0559675f1b0bc7c0d11c90503adb39
SHA2566924b41f5c9efb57ff6c9b252fc7094605eaa9393ff953a9790486fc81243029
SHA5128a4f735bb7740307dc92f54ff8baae599a207119b96398bb6d594a17d292aeafa344492c42527530c839963196a23a2e62795a28291b4602faf15cc736841a60
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5e765fa3b6917d6ce225ebf1b9e8d965c
SHA169fd589c0f7329fc04c3d0c049afd7e61412a751
SHA256b14638b4f52d9aecd1aa5baf8b37c240902b290d0fad78da633318cfb2dfc2f5
SHA5129583fbf1933c823e95b1061c3aedd158b1db87dc37b0cb6942df9c87858b989f5ef3880e7dccd4d61cf2f41d39c9eec9d02cf6919c415bb4d8b262ae26e6e6e4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
253KB
MD525c0999401049fc37225c063b07dd947
SHA1cb29d37fa0c52dacb9a6c10af18c76182aaf9a45
SHA2560c23a9c808e0dd26a665fcfecaea45576c50b0a2555f468d3a146c94a586fb3b
SHA5120b5314bc3c4b1bea0b8aea08040ce6b26a6ac0b64d8bafa2335449ee31bd0458ba9038444dc9043b96e82ff3b97055cceeec34951beec8b88e1af1864502e8ba
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4604_BDRLWFHHISXJZVJXMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e