Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
01/04/2024, 16:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://souq-deals.website/6uh4
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target https://souq-deals.website/6uh4
- Sample240401-ty3raaaa44
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133564625819738424" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 436 chrome.exe 436 chrome.exe 2908 chrome.exe 2908 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 436 chrome.exe 436 chrome.exe 436 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe Token: SeShutdownPrivilege 436 chrome.exe Token: SeCreatePagefilePrivilege 436 chrome.exe - Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe - Suspicious use of SendNotifyMessage 26 IoCs
pid Process 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe 436 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 436 wrote to memory of 4924 436 chrome.exe 85 PID 436 wrote to memory of 4924 436 chrome.exe 85 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 3928 436 chrome.exe 87 PID 436 wrote to memory of 4636 436 chrome.exe 88 PID 436 wrote to memory of 4636 436 chrome.exe 88 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89 PID 436 wrote to memory of 2356 436 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://souq-deals.website/6uh41⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c6bf9758,0x7ff8c6bf9768,0x7ff8c6bf97782⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1864,i,1564693357794755782,5311936882969386250,131072 /prefetch:22⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1864,i,1564693357794755782,5311936882969386250,131072 /prefetch:82⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1864,i,1564693357794755782,5311936882969386250,131072 /prefetch:82⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1864,i,1564693357794755782,5311936882969386250,131072 /prefetch:12⤵PID:3628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1864,i,1564693357794755782,5311936882969386250,131072 /prefetch:12⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4612 --field-trial-handle=1864,i,1564693357794755782,5311936882969386250,131072 /prefetch:12⤵PID:4476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1864,i,1564693357794755782,5311936882969386250,131072 /prefetch:82⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1864,i,1564693357794755782,5311936882969386250,131072 /prefetch:82⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1864,i,1564693357794755782,5311936882969386250,131072 /prefetch:82⤵PID:2344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5952 --field-trial-handle=1864,i,1564693357794755782,5311936882969386250,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 432B
- SHA256 848bf2364248a394287770b5fd765c34fe1814df956d699d2c1bcfbf7174b7e8
- MD5 208b73d0ac7fa1b3ab8cdd08dbc4f7cf
- SHA1 715ffdd2bc3c33401863b14d54fad05848c6fce3
- SHA512 ede92c9c08b440e27acf2ee4ada2ac6f388f7125b9c3d653af06e92e150913d6fab7afd9cf5a9ff73b3d1a333f9f9cfb2293313e6ff84753be03bf6e4b8feb91
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 c9d6b12693d6db4282d9985a79bc399c601a3784208a12ffa371f8a8f9a4d618
- MD5 804ac08e104b30b57a0991221dada216
- SHA1 5cfdf9f028e79d42081f47fac2cff24dd45f1fb0
- SHA512 44eda9ade6ccb6dcad16538d14bac73cdf16a14d98eceb2405efcf32c304a3cb7e5a73e0272de4fbffc97e7f9d7f4439db18efca441d84328de06bac58c8c160
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 875B
- SHA256 28c99cae60e8e7dd0c86bd2594a6c478ab192157cd4112f3e56c3ad241b13a59
- MD5 e98bf14e5a4532d480bb1792843ee499
- SHA1 2151bcbec473ef5e276bee010914698d07b92619
- SHA512 b435a423cdf9346610dc6c36e2c0522d55d5be672d98853ca17f41e03d4ca5ee68023a1466afe27496c973f7cf0e934ae2716410902eba58adc423ff147320cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 3a3f0c8fc5ad5fc362f31f95b577c1fe65fb2db5f93fee25de36d324f0ccb095
- MD5 d1045ecba90cdfd2f276cfdfeaff0de1
- SHA1 5c61cd162e4973d83ff1d398fcc1c529107c36c3
- SHA512 e3459ef24b086be9f4b328bde64f5b1665386bd4e5f49aaa61a7c0a74c1c218b51360b5a8fe906f9563f7df237f2649b4648bd1177d552e4437de780274fe12c
- SSDEEP 96:LfqBvN2XDxis4KIuv8iZRy7Di+6M8RgmdeVkS1wO0Py+x9tjVhYtjEsXt0/cg2VI:Lc2qI8syy+F80kS2botjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 114KB
- SHA256 5e2b7f9529b0f9ff8b4dec9e7c85a6a756c559109eeae126d147a6f1e5c08b0c
- MD5 2697585c28e3194a8720a3d81387b936
- SHA1 0ffd6a9a8cab7cedc5b8ecc4652a2d57c3f436cd
- SHA512 d3824b1e34234f5c0c9f8184541867f4cb163ed8dc3928a6cb4b5bc08b3eade09e414675396ebb067a59821902c8db17d12bacfbeebc710df26fe26351126fc4
- SSDEEP 3072:3jl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCw:3B+70xBmboJnf9/ToS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 103KB
- SHA256 002def60d76b32b65302412135eaa21736f9ce13d4da8801159fb068cf9e9e85
- MD5 4bcb82b78cbc74f9c5898528d80e1470
- SHA1 286ba747b9542e7f6c90c24a8e2d1c880a465722
- SHA512 0e50131c7c4660b5d4c32a9e9ee03f3fbc89e300dc2acbf5477ad80237b1cbc66cb1340ce2d9d78190b753724a101e11da139901368788e0361ca6ed2101baa4
- SSDEEP 384:+U6b+YjaMe0mQ7JJb9KHWQXpk4IbvcEBba+DGNCDkkCXJdbBYruGKALjznQC+Mz+:U+YmRRLR8jx+BO2TSK1Od2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5895d2.TMP
- Size 101KB
- SHA256 55f05e2425db59420b0df829b4f5d286cfb7cbb767e5f71388a3b2153ecf749d
- MD5 ac1bdc599c91c9075dd51781c89d016c
- SHA1 4a7ae5e3639192d47596c27fbb92408fdd3c97db
- SHA512 aba0906ade6ed9f5abd02948eb9065bf9d7226100058fd3b426b736ae3c6ee5810ba908d3950ac3fd005e220f057400c16faad8ace787deace12a6c112cfb78f
- SSDEEP 384:WU6b+YjaMe0mQ7JJb9KHWQXpk4IbvcEma+DGNCOkCXJdbBYruGKALjznQC+Mzmtd:M+YmRRWR8jx+BO2TSK1OdC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512