Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 06:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://conferenzia.hosted.phplist.com/lists/lt.php?tid=ex4LUVoGBAJaA0tQUQMITlYCVlNPWgxUWRVUVQRZAVBVUwFVXVNOXQBQUlNVWV5OBgEDA09WAlQKFQ4CUgtOCFZaAQcLUVFVVgQDH1JZAVJVW1ECT1AHAgkVAwRQC05QBVteTw4HU1IDBQUCVVcAWw
Resource
win10v2004-20240226-en
General
-
Target
https://conferenzia.hosted.phplist.com/lists/lt.php?tid=ex4LUVoGBAJaA0tQUQMITlYCVlNPWgxUWRVUVQRZAVBVUwFVXVNOXQBQUlNVWV5OBgEDA09WAlQKFQ4CUgtOCFZaAQcLUVFVVgQDH1JZAVJVW1ECT1AHAgkVAwRQC05QBVteTw4HU1IDBQUCVVcAWw
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133572907294182597" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe 4356 chrome.exe 4356 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 116 1804 chrome.exe 89 PID 1804 wrote to memory of 116 1804 chrome.exe 89 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 2164 1804 chrome.exe 91 PID 1804 wrote to memory of 848 1804 chrome.exe 92 PID 1804 wrote to memory of 848 1804 chrome.exe 92 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93 PID 1804 wrote to memory of 1964 1804 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://conferenzia.hosted.phplist.com/lists/lt.php?tid=ex4LUVoGBAJaA0tQUQMITlYCVlNPWgxUWRVUVQRZAVBVUwFVXVNOXQBQUlNVWV5OBgEDA09WAlQKFQ4CUgtOCFZaAQcLUVFVVgQDH1JZAVJVW1ECT1AHAgkVAwRQC05QBVteTw4HU1IDBQUCVVcAWw1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bdf69758,0x7ff9bdf69768,0x7ff9bdf697782⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1792,i,9852679836771130902,18186705999098580457,131072 /prefetch:22⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1792,i,9852679836771130902,18186705999098580457,131072 /prefetch:82⤵PID:848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1792,i,9852679836771130902,18186705999098580457,131072 /prefetch:82⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1792,i,9852679836771130902,18186705999098580457,131072 /prefetch:12⤵PID:716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1792,i,9852679836771130902,18186705999098580457,131072 /prefetch:12⤵PID:1900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1792,i,9852679836771130902,18186705999098580457,131072 /prefetch:82⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1792,i,9852679836771130902,18186705999098580457,131072 /prefetch:82⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3784 --field-trial-handle=1792,i,9852679836771130902,18186705999098580457,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2232
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:81⤵PID:4868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
678B
MD557b0b49c0d42b3db4ea56181477cf4f4
SHA1298c594b198f43b788b7a12e9cf651399bcb8ee6
SHA256c5f07788d83a398f29a67fa53cf5559aec3780a090b37931857d99749c7c58f5
SHA512296786b138a006c222ff5c638d1eb029845388ed56a3f35252c903c826a4a7185346113a280b6018ad47f1f919df8a69f62bb56e3696ac4185d3d9bfd7f20b70
-
Filesize
537B
MD5db7c59af2eeb4b16304f6fdb192f6730
SHA185e426a6cfdabceda6d6f4743e048f5e47c70b15
SHA256f001fa636a7b37958f4f89fc251b661749e5cb9d60319efe3455b8595f4ae9f2
SHA512d27e8ed98e642884e52573dbaa0f56797a745e9d9a35af888d0df68d9e6d3a48a98978e2a80124a6547150fbaa6434eab49d4fc67fb0fc2ff99d47365bc8950f
-
Filesize
6KB
MD5dccd74f1c4bc2c5c3c2d77d209360f0c
SHA186092da89b67f7663afd1b37e5854f091456956c
SHA256644086372d01b1661b450de1d4cd6afd8e1450b9be967cbb32a8b6430ac4ac98
SHA51261ef3f25952c963ce18de57d8e47e481337a75a4f04bbe995b850eea47e10c7053a1036d22b9cfaa4087a8b320e37f86457ce6a8ef374c6e76c07f87fb30c6d0
-
Filesize
128KB
MD533dabd7da17115eeee73b5561b29c3b4
SHA1a1fa89f507dc2854346f53a3b713c5475e583c91
SHA25678d4b91b4ab6a5210a5e76b6e779ef1eb65ed3c98275867ba1e99be7793958d2
SHA51288aecad0e8bac00c43263695940509051ba9bb7e909f296f38abac9c16835b27b13de7374627cf33ffb4000d275c6816db4fb42a4669d737c934ca04f4edad33
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd