Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 08:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://wix-l.in/k-lW5tukEM
Resource
win10v2004-20240226-en
General
-
Target
https://wix-l.in/k-lW5tukEM
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133567802974939871" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4500 chrome.exe 4500 chrome.exe 3864 chrome.exe 3864 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe Token: SeShutdownPrivilege 4500 chrome.exe Token: SeCreatePagefilePrivilege 4500 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe 4500 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4500 wrote to memory of 1080 4500 chrome.exe 86 PID 4500 wrote to memory of 1080 4500 chrome.exe 86 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1012 4500 chrome.exe 89 PID 4500 wrote to memory of 1808 4500 chrome.exe 90 PID 4500 wrote to memory of 1808 4500 chrome.exe 90 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91 PID 4500 wrote to memory of 3192 4500 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wix-l.in/k-lW5tukEM1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff882e29758,0x7ff882e29768,0x7ff882e297782⤵PID:1080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:22⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:82⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:82⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:12⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:12⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4656 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:12⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4660 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:12⤵PID:1364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4852 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:12⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:82⤵PID:3652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:82⤵PID:3488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1876,i,4088107537073752954,6973351957271464069,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3864
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6d91ba4c-7a6b-4e1f-a917-7e62633e8dbd.tmp
Filesize6KB
MD57459670c0317dea18499562c9f51b0ad
SHA19cb5ab13a211fd0648eb1f1bd4ed62fc33a2d391
SHA256b251ae2b48cd7eeaacf07261d89b0713577f21e365340ea1bef312076861fec8
SHA5126624c8b1ce666d23b42964657742c8947e7fbec95e64d3ab21e9c3b26484b0dc3f19e9abf77cb2d18797a80d0b798ddf3118961a6226ec4a753446a78281cb2c
-
Filesize
96B
MD5796dc4376741c767df8541026694b6d9
SHA13d16749021d9af74dbf2799383f23f0b2d16ae4c
SHA256f17e9839d7199c8510cc83ad5786954469e989c02fec17374113926f5bba986d
SHA512e008383fdc996801f6be9a67a98d4292bce66f23770c31511c3bb85635851af0d4fe8f1d4313c0a36efe84139615228c925fcdc72d1e96ca8fd42c7fae465498
-
Filesize
4KB
MD51cc27e283d526d8bb61e37bbe586fa96
SHA120df55759b42dfd53cfb88c887448b53bc9a6661
SHA256a7b5134718870e8eb016c0a21557ee1bd19f3ce3f20fbc7b8b803dc483c605ea
SHA5120bb0ab99fad2f428274e2507652be5d9d9e7ad2cd089e954bfb5ded00c3a9f6730844c314b0238eb03de7cc24875a8468cea904e7b7506db32282f0a27e823f7
-
Filesize
1KB
MD568804cdce5e44dce596de68fea95fe91
SHA1ae34f062e8f961bc314bc78e08df41bdb8f28ecb
SHA256d7e3e080dafdf89b56bce6ca9f6f35fa0b78cdcb4c83565f7181095a1ccf0fcc
SHA51233ce8daa501d9b0b6975b3b8476226eed291385714836b250fe560b54459bc8e3ac3253030ef83fdd5c02f59eab22cb834b7b52a9578cf0240f5e2a1af082145
-
Filesize
2KB
MD5c1b0bcd131dab60450c4ac265c61e1d9
SHA11d67184e9fe61b497208c4cd8c9c3669b124c4ad
SHA25693b738de26bafc9a7361ec51dd80b13781587b2ff75ea895f22e1ed13e201960
SHA512b8a6d78af3b4672be88e2949dc9e77a1817fd7b43b7383e6059518196fc9e2bfe74cdbce3dd5e42346c1f13172e0ac8cff19ee976a1fb731638d9cbab422098f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD53563f44d5a8be0b0192974740d122700
SHA10ee10dda49eab50fa1d6da7d2a3a85d4213d2574
SHA2564dcf3a2c0b0f58b3f304e2cabe96c5e2ada3d929105fcdaf7d7a72d56e334326
SHA512708c9a07fb4eae6907378a0c56ddc6b5319267e31d55b5f8de2f6c73e9546653184f8463e6e0786b8d6c752bbdd879c97444b9a4d5e0e243b4f2b3c9bbab41bf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a25a.TMP
Filesize48B
MD5151e35c9ecba090c6f85e60089ceefd8
SHA16acfb25fd0c606e86348ce8315e193f271ae20e5
SHA2567ec1dee289d9b848a7d5015bbed195e9b11c40aaec586e585d8df9d563da8aae
SHA5129aad5753bd4b8cb2a11c876c5d6cc628d0d3fe1139d5eb8c3025d50fd85218ae6db51dcb82c3871abbcd0612936d604e07b15c9ba735719ce4a9a94a85ebcf29
-
Filesize
128KB
MD56915c1b8be1f7f1875920a02c7830da9
SHA14af1edee5b131485b82ca3370358b8ff0130152a
SHA25689b9695257f1538a2862b6b16b0d42aee9bfb916633e3f23a7f368afbc14824c
SHA5126e36cc406b08dcb08de6355b6984bacd6cdb3b4134b67cecd2cce46c400929e4c91dc535f96f0230c809eaa4cc976c098061874d5524088591a562a51cf75337
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd