Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04-04-2024 20:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gamma.app/docs/You-have-five-5-attached-document-file-awaiting-5rlmp4d9t8fn19p?mode=doc
Resource
win10v2004-20231215-en
General
-
Target
https://gamma.app/docs/You-have-five-5-attached-document-file-awaiting-5rlmp4d9t8fn19p?mode=doc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133567355108835359" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1696 chrome.exe 1696 chrome.exe 3736 chrome.exe 3736 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe Token: SeShutdownPrivilege 1696 chrome.exe Token: SeCreatePagefilePrivilege 1696 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe 1696 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1696 wrote to memory of 2376 1696 chrome.exe 86 PID 1696 wrote to memory of 2376 1696 chrome.exe 86 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 4112 1696 chrome.exe 88 PID 1696 wrote to memory of 1796 1696 chrome.exe 89 PID 1696 wrote to memory of 1796 1696 chrome.exe 89 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90 PID 1696 wrote to memory of 1744 1696 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gamma.app/docs/You-have-five-5-attached-document-file-awaiting-5rlmp4d9t8fn19p?mode=doc1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbf589758,0x7ffcbf589768,0x7ffcbf5897782⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1888,i,9510366654987615123,5380993316361221558,131072 /prefetch:22⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1888,i,9510366654987615123,5380993316361221558,131072 /prefetch:82⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1888,i,9510366654987615123,5380993316361221558,131072 /prefetch:82⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1888,i,9510366654987615123,5380993316361221558,131072 /prefetch:12⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1888,i,9510366654987615123,5380993316361221558,131072 /prefetch:12⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4960 --field-trial-handle=1888,i,9510366654987615123,5380993316361221558,131072 /prefetch:12⤵PID:4088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=1888,i,9510366654987615123,5380993316361221558,131072 /prefetch:82⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 --field-trial-handle=1888,i,9510366654987615123,5380993316361221558,131072 /prefetch:82⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5144 --field-trial-handle=1888,i,9510366654987615123,5380993316361221558,131072 /prefetch:12⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4756 --field-trial-handle=1888,i,9510366654987615123,5380993316361221558,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ba128a76c798fa1f6cdbc692cff8101d
SHA1dcc046ac07df90edefbd23a3fe2355a85d264571
SHA256fc6191bc36912c85d63f8d040301149f132cd21ac35e18bee366870f82ab491c
SHA5124ad0c2427aba786f9585ad6030f7cea9a443e54690b48878d437b44fe7615c916f084425fe3d30c0ac865383a7adc732d0ae03b79952ae8d430121c91e549e44
-
Filesize
3KB
MD5ed6355049ab8f6916ab586894f255d69
SHA12db2d4388e7e250e8d02dca86472f6812713e56e
SHA25624e3d42848c6a351118830aefb29874a0dad7a576cb8a2b965cbf0dbe69e2b43
SHA5121174312b67fe4560942dce5959052dd8949bb5a4c6999663987f33c02d1b645314b01b5e9ea5006c0f13d9168995ba2ab4349815653f8e669db5bd6b260bd50a
-
Filesize
1KB
MD5c4420b21efa0a3f5fa418332ab9fc9ab
SHA144c221658d5a73a6673a9de30673f74d9cf6bfcd
SHA256faa3b4ced24518404219e3fc10fc59341b9d4b1b5d20e977d9816cebbdca0f72
SHA51263d4109a834ec5171201f6b73a044ce236b144edcd26f79686713a11103724109ca0f1d60e567a54da657059d4df8105f587768f766279395053580fbedb790b
-
Filesize
1KB
MD50625b51668304060921a8217a9ec932c
SHA15db0d88628d0bc905c503818bc4e765fa37d33bd
SHA25671244ea960e5fda4e8262cfa06bc1ed0ed163d55e2b511e12484dea98510989c
SHA5128721734196fb5dae824f74ab009874c5cf861a4d577bb5006f3078ec0ecafa74d50d9153c7a95762656e138152fb23a3acbfab1bce5ef8bb7921bc136cc209e4
-
Filesize
1KB
MD57faf83479b5dd247e7f08f5d4d542c70
SHA13d01f4ca5e1e1ca3e8d684bd6613405ac30b56a7
SHA256506ee74dddf166dd4ca3f644a6ed4b48afd8370171273cca3a3a023c5ee440e9
SHA5127642f9b2f31f819ae90d4920b4c9813920d442e72d480ab91430abe6c5f1271afc8f9b4826bcc077f3305f1aa056691d74cd5f564db05c8b56b02e9b5de95035
-
Filesize
6KB
MD512ac59eefdb5e56f2e276099165ca4d5
SHA1ce2423065bda13d7e480fba1bbddc88d6553901c
SHA256f2deb1600fb2dceb10938cd479894c44eb0fddd65e6b20599fc5194edd003896
SHA5125c32017643f8ec3d2580b5963527ecba6c644a5db5e18c92a55e4b0fabf5c662a88cd07e1e7e97d113fd3c2afb16fda6a2c22e60a5a0d89fb6538120ef002fe9
-
Filesize
114KB
MD59aabc4308d64c35912450592426f68df
SHA12f3ff984b93f632249f0f35b3619b7b65ee7d89d
SHA2560133f9a96d8c563c459d967ce26d575bb4df8840105b18a5ceaaef27f4c75926
SHA5121e489d42f43bc6f3eb938b616b7a2df97b27325ffe0fb5a4430da739f8b4266b13564e9237220911a8a13fc7f1eeef44674f1f943be3d7a721aefb139e5f7108
-
Filesize
114KB
MD57076a9a90c151180d8c6850fcd049db2
SHA1bba7c2625c3d49391498445ddb94a70add858b85
SHA2566bcdce6ef94dfbe0aeac8b5c3b05dcb57c9729ab3b20a28d36952da0030e8bf8
SHA512b044aace8dc61a21351dd3e862cc815660307c11d15d9252184f4a7b9dd81410e6098542e5a9861533bc86e6a56adb54aa1b749939c1a55f335dc25107347915
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd