Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
07-04-2024 20:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://QPTR.RU/EDcn
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
http://QPTR.RU/EDcn
Resource
win10v2004-20240226-en
General
-
Target
http://QPTR.RU/EDcn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133569959268092568" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4896 chrome.exe 4896 chrome.exe 1376 chrome.exe 1376 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe Token: SeShutdownPrivilege 4896 chrome.exe Token: SeCreatePagefilePrivilege 4896 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe 4896 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4896 wrote to memory of 2412 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 2412 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4704 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 3432 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 3432 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe PID 4896 wrote to memory of 4212 4896 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://QPTR.RU/EDcn1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffea6099758,0x7ffea6099768,0x7ffea60997782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1840,i,1663123500126600868,14796912378748889862,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1840,i,1663123500126600868,14796912378748889862,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1840,i,1663123500126600868,14796912378748889862,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2624 --field-trial-handle=1840,i,1663123500126600868,14796912378748889862,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2632 --field-trial-handle=1840,i,1663123500126600868,14796912378748889862,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4480 --field-trial-handle=1840,i,1663123500126600868,14796912378748889862,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1840,i,1663123500126600868,14796912378748889862,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 --field-trial-handle=1840,i,1663123500126600868,14796912378748889862,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 --field-trial-handle=1840,i,1663123500126600868,14796912378748889862,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
384B
MD5ad3c44e135bdb957f767f14e495713b8
SHA169196f24b5d6db2f897f254772130d068677106d
SHA2561981405719c180036d3d8b651863fbb5e5bcd352789d40b5dc6f8db3b964f666
SHA512b1c7dd7f785b993275be6087748a787989ae1a542f6b40e18bd0fc819fc3b1ce6dd9e04376c97695fafa6f19146274ad9d13ac277f1daefc8565d74fd58145aa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5350c97a791a1a62732bb9a8b685b74e9
SHA1739bc464968d554617616a0939e6c50c058302c1
SHA25641940364d865adbbcb8b9a061a5ed99bbb3125833003d20b474824f94c693b7d
SHA5120608aad47b7de3f7a3ca815c955340c291014143724b79bab5c7b96601afe2fbfffc27f8b1d3ff12ac554431839a4c261a8f449eb75aab02b841ed6759446b89
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5a240b8f688dbedb8aba34401e9407fe5
SHA1a82e5c04adff67dc6bde534fa9d4522edde82e7d
SHA256f7bc72ceafa55e74e13cc74a37f23f9dc6aa47440526a193d73187f61e2fe80e
SHA5122c54e0886567ab352c803ad23f1df712ca365091ac3485d200b29e8cf816e861d8d28dd66c2c4e5ad29bf8698374edbfcedddb5822ef08b9d9ecad9338d46965
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5b72062f1b9152cc0d3fdf00fc4d04097
SHA1241cc7f14092b6d7f3ba08368f3e8eb098df1bd2
SHA256cc70a6a0d59fffd4642338d3dd9217ab87bae1b39e03ab470b99a88953281dfe
SHA5124beab9539b6b15375443d405e08d139438d4eba1e773ec1e6596173ecd7b3c6e0d273213ef4d5bfc3a11eb9e03a89a18df7828e2ca244f86e08f5dec30f4d077
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD55c0503d64ffb547b5945ffc84bb1893d
SHA14488175b6a8ec9afeee929298874fa10ea78a6aa
SHA256f515efa53a7bc2bc53658779ea51096d5e8d20af7cb9cd21012a0e5eb76de0d5
SHA512a5ae8ff6d3e7ff214c61ae943ae2dfd26e3779f30af414e7b0435e0c9e05c691e1f7f68fc38a3c2e0532b5abef72271f8fc54a64ed2e193344324c39668a3138
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5072caa8af005f2d556cf43f3d2284a88
SHA1f4ab70a058f20108923a4c2dad5904ab31fd581e
SHA256cc84296d221fe60d2f56bc35e8c8dbb151b97b44cbf299878fa605554f38a7b3
SHA5126d1ecf882f8df715e16b0b4436c721838ad2b87cd97dbeb961f996d97cb037025accb4d69bde00fd866bd29506089dfdf8fa53a6e14ca5b969fa9a09a3a841f5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
136KB
MD5aaab65989af252ce354f319c776c01d4
SHA1eccde6d9a67a2976c9d572c1fffbc457b1d5d446
SHA2560b7378e32c45e854d1c000ae118b5d9cee9e83e9024ca6828db4f0ba9f30aa03
SHA5129aeead74fca41e8a053ca56fef6b466420e7660fd8e0b3994ce32018948fe2b469ac0d26d321d08876753fba30ee3ac7fcb8c19669e827875063dc4faf89b15b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4896_SBTFPJGSXBOVOTDJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e