Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 04:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://alpineintel.com/resource/the-savvy-adjuster-newsletter-adv/?utm_source=cj&utm_medium=advertising&utm_campaign=newsletter+promotion
Resource
win10v2004-20240319-en
General
-
Target
https://alpineintel.com/resource/the-savvy-adjuster-newsletter-adv/?utm_source=cj&utm_medium=advertising&utm_campaign=newsletter+promotion
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133561595340523073" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 8 chrome.exe 8 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2064 chrome.exe 2064 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe Token: SeShutdownPrivilege 2064 chrome.exe Token: SeCreatePagefilePrivilege 2064 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe 2064 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2484 2064 chrome.exe 94 PID 2064 wrote to memory of 2484 2064 chrome.exe 94 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 4852 2064 chrome.exe 96 PID 2064 wrote to memory of 2272 2064 chrome.exe 97 PID 2064 wrote to memory of 2272 2064 chrome.exe 97 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98 PID 2064 wrote to memory of 3288 2064 chrome.exe 98
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://alpineintel.com/resource/the-savvy-adjuster-newsletter-adv/?utm_source=cj&utm_medium=advertising&utm_campaign=newsletter+promotion1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc41439758,0x7ffc41439768,0x7ffc414397782⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1892,i,7662621943467915559,8538023536792423854,131072 /prefetch:22⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,7662621943467915559,8538023536792423854,131072 /prefetch:82⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1892,i,7662621943467915559,8538023536792423854,131072 /prefetch:82⤵PID:3288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1892,i,7662621943467915559,8538023536792423854,131072 /prefetch:12⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1892,i,7662621943467915559,8538023536792423854,131072 /prefetch:12⤵PID:1912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1892,i,7662621943467915559,8538023536792423854,131072 /prefetch:82⤵PID:5260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1892,i,7662621943467915559,8538023536792423854,131072 /prefetch:82⤵PID:5340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 --field-trial-handle=1892,i,7662621943467915559,8538023536792423854,131072 /prefetch:82⤵PID:5916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 --field-trial-handle=1892,i,7662621943467915559,8538023536792423854,131072 /prefetch:82⤵PID:5924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1892,i,7662621943467915559,8538023536792423854,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:8
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4608
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4084 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:81⤵PID:1696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720B
MD5d6f88bbe9d980dd11de44406d3122ea9
SHA1ea75b8499fe17223610a04d61eae774487cd063e
SHA256e36b98d70408cccfbddc8a76c9a9a095b8cd717f629cab474f1dcb3267b5e54a
SHA512600e35a8166d3d1bad06db354554ca7aaf4f57e471b6e81c10261b418a37b47ef9e5e87ee0355670b087f8ad18101547c1e068a26de562ebf9cbbc6f0de15a5e
-
Filesize
3KB
MD59eaacc3ce088ef2e2b16be0ec3dac408
SHA16a9e789e697cab35876a79b0c7c58f3e9870894e
SHA2561fefcbe73f037c9304bb7275fcaecd28002fa7bf44c9c1137a9387f630e6d27c
SHA512548b688cfadd4f961a41f8638ff67200e52f064f40273bc21be3360c16ecb4b6d90c212817abb9f2b14e6739ab57451c7acdd66b7b3d86777c34900847d758a2
-
Filesize
1KB
MD50cf59310ef8b096d533d2ad794157b07
SHA187c3c97091a661bc48ca371dc4c7d6a4b1e59064
SHA25629689a273c4262ac3981c3cb8c40e35272231d4dc811ad657aa9a2aedab90b3e
SHA51281174c8cf23a3e177da4f8d2dc46d355ddc41ecb344e099b445bc502e66fb3052bbf8439ec54eb696101dfd996bd74970218ae302642de271e85b5018a7619e2
-
Filesize
6KB
MD5d999cb53b5749f6a60e6ca922c2bbbc9
SHA1a9659b3ff792a5809cdc7c7dd22eae72ed94788b
SHA256da94fea3ad06bad926ceba9287e07b70936e28d79b5b4796f3014f734a1bb4f1
SHA512d0cfc5f304bb94d037dc53b9435110b33f03f76bf45def5e4f3026f84df3117d653eceb5bd1ff7b7f19e6d852c35a427d5e180aa547ca6f5957600ae1287a5fd
-
Filesize
136KB
MD50c2fcff745952dbfc25fbd31d58288ba
SHA19e5bb4692e413595d7f333a20dd728df3cd36c65
SHA2566a2d34d2e304236e2e5ef34687e1726bd94e4af29f780df29726c97d99eab8e3
SHA5128be9260dae2c5c533f1f5afa957b45f879722503683619f99b53ecb4ab720310a3ed5104db1321fc3eadda5cea5d80b8a00019ba6eb61abdf13c6e1372c91d1a
-
Filesize
136KB
MD5d54ec9c1221b7ddc23ef7f3b53d79991
SHA172dcc8573b8cc2296bca4417f0b66a068f5a00e2
SHA25666196ec51cd56facf89dab49363830aaf3b054ac824153aa6b1725c8b75c0ea2
SHA5123992025af109ce5133cf940b341f49ecb74f223166f740e8b1542889bf5d94a1081f8f92506eb957b0254acb41400880840cf4fbcd6075fc3c998b43e1591cb9
-
Filesize
174KB
MD590b1cda58eacab3a51b727df3d0416e0
SHA10982623b21815112af91b165d68faec550b5048e
SHA256572b77556f93673d813a399ba720f21ae34ee95324967002499b40adadad3e19
SHA512ffbe0a24dfe0f7d8145ec5c31c0ea5537a12c422c10102be5b93da192a5f6e64c30d3a5d5e5fbbd78934130ade08a933480ce674e9a2600de1d465b374a05196
-
Filesize
136KB
MD510aa2a35b4836435a5331fc12478d8f7
SHA13d484544d6a1ced884c37adfbed8927af1bf9487
SHA256a4c0775d58ef348c788902d8cbffa1cff9f224571647a075a994318295600649
SHA512cfb1fa4a71cbace5d3dc50929690a2910ace8c240237ec95e0449c13bd8b54b4309fc7aa57e99881468c14826206f7d6eef381db3e099274322d50400c93d9d0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd