Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 07:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ciss.reddoxx.net/?1660-1-2FDA1D4B23
Resource
win10v2004-20240319-en
General
-
Target
https://ciss.reddoxx.net/?1660-1-2FDA1D4B23
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133571201727183503" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 5816 chrome.exe 5816 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 2140 4712 chrome.exe 90 PID 4712 wrote to memory of 2140 4712 chrome.exe 90 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 3108 4712 chrome.exe 95 PID 4712 wrote to memory of 1888 4712 chrome.exe 96 PID 4712 wrote to memory of 1888 4712 chrome.exe 96 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97 PID 4712 wrote to memory of 4192 4712 chrome.exe 97
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ciss.reddoxx.net/?1660-1-2FDA1D4B231⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffc87119758,0x7ffc87119768,0x7ffc871197782⤵PID:2140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1928,i,1441099234841367446,10967501259021457103,131072 /prefetch:22⤵PID:3108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1928,i,1441099234841367446,10967501259021457103,131072 /prefetch:82⤵PID:1888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1928,i,1441099234841367446,10967501259021457103,131072 /prefetch:82⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1928,i,1441099234841367446,10967501259021457103,131072 /prefetch:12⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2920 --field-trial-handle=1928,i,1441099234841367446,10967501259021457103,131072 /prefetch:12⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1928,i,1441099234841367446,10967501259021457103,131072 /prefetch:82⤵PID:5360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1928,i,1441099234841367446,10967501259021457103,131072 /prefetch:82⤵PID:5472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 --field-trial-handle=1928,i,1441099234841367446,10967501259021457103,131072 /prefetch:82⤵PID:5400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1928,i,1441099234841367446,10967501259021457103,131072 /prefetch:82⤵PID:5344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 --field-trial-handle=1928,i,1441099234841367446,10967501259021457103,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5816
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2412
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4116 --field-trial-handle=2264,i,7994609493164365963,13212734413040148104,262144 --variations-seed-version /prefetch:81⤵PID:3732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD50360ba2f8bfb211fb5d800b7ea4c9d91
SHA10fd047022b6b66cced0731289d0432e68d577d00
SHA256e0f0a90018ef0278f03c5ddf6291a5983259db821faf2f1718eec22a3102900e
SHA512260659d9d47e0b3133542ac804fc4409992302bb363653e6908d15b49cf79361bc2d5c7993db71fa70fef6f12954f1dced19e9b7a3a27440adf52563d764c781
-
Filesize
1KB
MD56c7c964a4639f0af85b3d53a56c4b98e
SHA1aefdd05180b53b3789108a9098e891424cf96a79
SHA256415c9c18a3a98ff2429c00d211f7b28b465c1da0f2baf85303c8610280ee10d8
SHA5121b85a64fe452a28b54c7746a0c4e9685079d2cb0345ac716188911614cf76ad4f34320ace5b00cfb53849c97449e22abed2a7c8a0158a2bb9ed1f3b33720957a
-
Filesize
6KB
MD51573397544d6d83e3aea8d7cfff3e3cd
SHA1053b09fbc365b8ae0622994bdfd075a4cd3ec776
SHA2560283b8a8703418b0604017d334853be1218380300d8352dfcdac112d7df97e82
SHA512a67c1335a25d8fc47ff93483c43dc060e8d669a8303ee187c48f8533d9d6f69ba6dad5cae51cbd77fa38475df0b6247b149abc0f5a425b56367a17fd69b0294e
-
Filesize
6KB
MD5390c21ab57ce26dce91159fff583c1af
SHA1e88b5f5f296d9974ebd7fefe62e9ef1f4ea75e1c
SHA256acb62080da92b846a19ab01d110b30b2aa335ee58bf260e574773f7e9c3680a6
SHA512d5d522bd29f4cfc953ba33ca3855ae179ba20635b350329abdcd2d90be3a464b08d50f3ac1d1cddc2a8a5768bbb006f1dc13945d90c61cc1f5ba6bce3cb5021c
-
Filesize
136KB
MD5fdb9327fcb98db8c94fc8cb7b92e0820
SHA1d924b6e5aa229fa846ae7aaedd5b8e8c147ad07d
SHA2567ec147cdbe89dc5e4e1c9a592e0729567ce6a09524b1d7403e68b80b6d7f17fc
SHA512e1d3bcb6543e106c9248ef6fb2d91dd0a238a1923752490565426b6bdf0c33f24d30a6d4698d6c969e5ab13693b8df08bc3a7dfa582abe4b7f8a3b2a247590c4
-
Filesize
155KB
MD563f9bb7216e3e1f4e116780bb37da3a4
SHA10ddb304aaf8ec78608c9a9d5a75bea58a138deff
SHA2566a0df5c8b412581eba3042e95b3299b73c6a2e31f434e9ef95bd979f395e4803
SHA5121ed9d9c16f26f76cec569518691a852826c006098f4946d31833c7207f8fac5b996e2bf282ab1640a752b0dc4e402139fa95763b029e9852631fbbf783945a51
-
Filesize
136KB
MD5cfe86a13f69cce32af35fca79ae93cc6
SHA1c88883d7b0d4d948fa89a027cc7296ff90cfc8c3
SHA256f81be38eccb6aa0968dee520dc45dc61e0228595bb9d4157398131ffc6fe58bd
SHA512feee02fc62d7c3ce49d242217c7bd846ff6a24c9a9a01f5e0b16844f0d967a87f5ea8b645786736cee78f5d9d983b6319566f0fa7460b8c74e7a46bd58fc05fe
-
Filesize
136KB
MD521b06592380b98b73eb441ae57b2d2ca
SHA11c9db45acbb87389e9dc970a7cf7548e993c14b9
SHA2562f58db8ef15ed63919ef86cb58b6f01f987278623febb54bd87a419e9901a37b
SHA512b66c73ce59af39f54bd494d61aab2f772d0bfc81889f2036944648460dcc6065ad1ed2b1d0ee7d59afa7fcf9e96e81915eff671e6b3bb2c988971dd3137b1f46
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e