Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 04:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sw.recruit121.com/img/ktpnxcqd7jr1n73x_l3bzujdfowunhnaenm7yq
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://sw.recruit121.com/img/ktpnxcqd7jr1n73x_l3bzujdfowunhnaenm7yq
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133559875448352644" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe 1496 chrome.exe 1496 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 5012 2592 chrome.exe 86 PID 2592 wrote to memory of 5012 2592 chrome.exe 86 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1360 2592 chrome.exe 92 PID 2592 wrote to memory of 1632 2592 chrome.exe 93 PID 2592 wrote to memory of 1632 2592 chrome.exe 93 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94 PID 2592 wrote to memory of 5072 2592 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sw.recruit121.com/img/ktpnxcqd7jr1n73x_l3bzujdfowunhnaenm7yq1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa53fa9758,0x7ffa53fa9768,0x7ffa53fa97782⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1884,i,6042497879401610302,5539654988040166146,131072 /prefetch:22⤵PID:1360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1884,i,6042497879401610302,5539654988040166146,131072 /prefetch:82⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1884,i,6042497879401610302,5539654988040166146,131072 /prefetch:82⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1884,i,6042497879401610302,5539654988040166146,131072 /prefetch:12⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1884,i,6042497879401610302,5539654988040166146,131072 /prefetch:12⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1884,i,6042497879401610302,5539654988040166146,131072 /prefetch:82⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1884,i,6042497879401610302,5539654988040166146,131072 /prefetch:82⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3716 --field-trial-handle=1884,i,6042497879401610302,5539654988040166146,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1496
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c489019df537ac0a0becbb2bde25f326
SHA198d0f7ab675729130c1e0e3594e1a47b90ba5d48
SHA2563f7b8f9dd7bd391ee47c2dc38e873773f3c59f49cf9ba6bffcdd708c184f18ac
SHA5124bb2f0ad93a54627a06bf728511b53417e15994396eb4862e9f81202bfbfeef84204d9cbb2ac2bc126fdba36c2ca7de97f8c219dae10e4f7df9b7609d6e265c7
-
Filesize
6KB
MD501917055b1a7dfa8eef82fa36d62c4b8
SHA1248b087f306fa1df2784c446d65c7b9a5edb3ca2
SHA256741898a550a683bc2259e57246ab315031194b76a50758e5a0ff23ee977d269c
SHA5126791b683e769408e93b071dd643a214956595e31c4e6c6316792a5aed45eb5dd54dfbe9c47aa665637d44e47a1db2f7b667e4da0b8e123797f5252acf97d41b6
-
Filesize
128KB
MD53778876ce8c46bdfee4364218c2baaca
SHA1e87f87e2585f7888b713e4aea48c84e3d620eaaf
SHA256540a65349d326c1bd0c0f13c934146792f602534280e8e8895173c6fd1f93f6d
SHA5121dcaf54a33e76da143f29df034fab3a102d5331b04c43e88733eb5ee57bf0bb7116cf820e13313988954d79292b4e3eac252c24a7959c3dedf2f941dd23a75d6
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd