Analysis
- max time kernel
119s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system - submitted
02/04/2024, 15:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://xekudi.wordifysites.com/ndrive/Payment.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
https://xekudi.wordifysites.com/ndrive/Payment.pdf
Resource
win11-20240221-en
windows11-21h2-x64
8 signatures
120 seconds
General
- Target https://xekudi.wordifysites.com/ndrive/Payment.pdf
- Sample240402-ss2flaeb99
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133565450574068257" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4588 chrome.exe 4588 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4588 wrote to memory of 4520 4588 chrome.exe 77 PID 4588 wrote to memory of 4520 4588 chrome.exe 77 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 4856 4588 chrome.exe 79 PID 4588 wrote to memory of 3120 4588 chrome.exe 80 PID 4588 wrote to memory of 3120 4588 chrome.exe 80 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81 PID 4588 wrote to memory of 1940 4588 chrome.exe 81
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xekudi.wordifysites.com/ndrive/Payment.pdf1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd0cf49758,0x7ffd0cf49768,0x7ffd0cf497782⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:22⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:82⤵PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2152 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:82⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:12⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:12⤵PID:3320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4472 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:12⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4696 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:12⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:82⤵PID:3748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:82⤵PID:616
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 34bed7c86ffa465aea1770a9c889034b5524124ff4b20272b2e19596d6c42eb8
- MD5 76b9008375d1632d9d12a44272240ae8
- SHA1 ce634ef4423b863cfc0321012c9bb60921903911
- SHA512 25adc4ebdbb743f51ef1233b2f5b6bc73e38d48c1de2f9feac4ea85fbf9ec8c0a4e3063e5dd3366b1bc270ea764e4ac9dd8112687db81a34bd8e36f9f7615e86
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 757B
- SHA256 0bfe2e0249dab6e579fb5bbbc93dc03868a1d92cc9aa2dd19709c091eb6b28cf
- MD5 3efdde194b0f3fe03c25ba781271aca1
- SHA1 c6911bd87661a5906bfffbeab5b2be5f977dee9b
- SHA512 0162761afb3202f15124137998a01eeedaaba5180f2f6432bb1f98214caf81b04a03bd0c93d50dd3c2fbf6e5e04a6336a9a882361d8763997c772fab642e93ea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 c197cadbc0abde53accd228ef089aa8632bef3990b128398fba7343f87212817
- MD5 a2f283d717cb15e0940a8b842fa6f09d
- SHA1 89a03ef70daf6b5a8a5217e121d600a04d84d5c5
- SHA512 7d288f35392d4872de09063186869c4bb831851f83e39bd06cc6e885e8afea82bdc7e331e64478e56bf824af16b4e0154c8b49bd2c81a5fd2c764454b25f9c23
- SSDEEP 192:09PvEh6amW8r8syy+Flku1X0cv4otjEsXtScPS:09PvEEamfdyxj1X0cv7tIsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 d8e856b0118eb9ac294dc428a1d4fec2ae69f03816f164788a85a90be53a79d5
- MD5 a97d5e18021b63ea7965338e97994f47
- SHA1 55ce52fd55acf19ed8fa385cf7c2513769a5d931
- SHA512 cb929d234426f2886d0d8c1021372e2930ae1e7f8010d2b7e58ad2b81120f3a3a83726dad8e5f2411fe61a20f1411a13e3ac38eeb9cf7a0c34a4d68cc264773b
- SSDEEP 3072:cJ6d7vgj3QHaVRgyKWTHyNiKyc98jbN2/kl4oJLutF/K5W:cJ6d7Yj3Ua9jHThM8fNHK9K5W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512