Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16/04/2024, 12:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.fmtna.net
Resource
win10v2004-20240226-en
General
-
Target
http://www.fmtna.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133577455149076350" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4832 chrome.exe 4832 chrome.exe 1932 chrome.exe 1932 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe Token: SeShutdownPrivilege 4832 chrome.exe Token: SeCreatePagefilePrivilege 4832 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe 4832 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4832 wrote to memory of 4048 4832 chrome.exe 91 PID 4832 wrote to memory of 4048 4832 chrome.exe 91 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 3316 4832 chrome.exe 93 PID 4832 wrote to memory of 1204 4832 chrome.exe 94 PID 4832 wrote to memory of 1204 4832 chrome.exe 94 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95 PID 4832 wrote to memory of 1948 4832 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.fmtna.net1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ff9e6ac9758,0x7ff9e6ac9768,0x7ff9e6ac97782⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1880,i,9400561619012780053,10541361421882599858,131072 /prefetch:22⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1880,i,9400561619012780053,10541361421882599858,131072 /prefetch:82⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1880,i,9400561619012780053,10541361421882599858,131072 /prefetch:82⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1880,i,9400561619012780053,10541361421882599858,131072 /prefetch:12⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1880,i,9400561619012780053,10541361421882599858,131072 /prefetch:12⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4888 --field-trial-handle=1880,i,9400561619012780053,10541361421882599858,131072 /prefetch:12⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4980 --field-trial-handle=1880,i,9400561619012780053,10541361421882599858,131072 /prefetch:12⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1880,i,9400561619012780053,10541361421882599858,131072 /prefetch:82⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1880,i,9400561619012780053,10541361421882599858,131072 /prefetch:82⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4700 --field-trial-handle=1880,i,9400561619012780053,10541361421882599858,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2268
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:1532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5f6c535d3a6e8b275e4ceb35bdc4ca754
SHA1af63a14a72ec2deae17bdfe177c624f8d9276445
SHA256b96968546c852726ce8023d3275419af6915e68f72bfdafe94488073bbdc2574
SHA5126340209b10e98983fe38bec8ebc23af759ad8db0da9b3828b18063bcd802b94c7b836fa9015c45b6994c58fbcab9ef848d6d84014b3dedb2756b20517d4f6f47
-
Filesize
384B
MD55b5702efe5188e18556c9bae7dabd83a
SHA1ccb8979abdd7dc3772c79a2e982f14265c7ada1c
SHA2569548d96b5bc0d1837c3e80ffc74845b09946fe6804f37bdc04ca90d0ad401393
SHA512c8c4743ee2f012895f0fe2d74bc8ea49face524f6d0bb1329f8e1bc447195aa322ce0935982d1a3ea2289c14b7424c40769eee8ea4e840784c07de56ec05dba0
-
Filesize
644B
MD521f122442dd79c383c788ac2d60840e8
SHA1bcaef0565cf5a2a7b0938905bbc81692c5edd836
SHA256712956b9f8e256ca9d02efb77ebe3cc4fd67db821a723ccfe91b33fc713fda8a
SHA51245cbfd97cd82e2719928338f20f1aa1682f995ba90b2d53c16a7c16544c26f0ee0ecfc86a8be54f68687e57a2015bde49d3c7928c78bad295bb8377e18958e19
-
Filesize
6KB
MD56286f59ef2ae15dd3d75368d2c380fa1
SHA1527893a7dccdafc218d21d4a6ec43eefd8bb66bb
SHA256c0458a3cc7884aeabd5b54345fad2f701f876e3baebbbf227479646575680f91
SHA512db12988d1645026fa51ebca1a298df081b9143cc7d84185b1b4090eea7dc554bb19dd8e2ae37ef90a1ba33096805deac48cb3bc8ebc816d86f2ec8862badb39c
-
Filesize
5KB
MD5b0a81eef63b3a090b466c03076659b47
SHA1ccade900c88c3bbf58b5425c82182b1e6f3a0251
SHA2567acf72171dee3c03471c0a05b65bf0f9487d104e5d251ada10abd58f8968e54c
SHA512c75cf53031867e228b011eeb2ef5abac0266fb685f5a2764b797e80e88b780d6f471d76e7b30d3dbe586a4209ab58ec7073153f1bfbe92dc88d197df869d0068
-
Filesize
5KB
MD515f2b69a4ea9eed34e6edff911188a0d
SHA1fee3a791b6f06a0f15bb1f2f8146584a43322772
SHA256f7d204670cb686e5bd403f3f5ffdd80b62d04949387f7895ecb525d35282221e
SHA5124e55723ed63782a905ef35af93c7ea3f06183b7bc8a1598388bef40046cc293e4c658a0fed056fe417d07a45b6d72c7d0fbeb0256f8ff0a4dbb64ac75b35a11f
-
Filesize
6KB
MD58f657727c87bd660d689e8645d33df47
SHA1277aa65ef2edc00b44a6652ee6e03059d735f927
SHA25616ca86a6f9b0ae40a9d08649a0e984c350dfedbaecf7dd194b1925e9f004fd27
SHA51276ffca1fc9c19ac9fd43f1e4742eaf9329389a5d3e6a77329b5e9dfb890be010ec9de7c7ade1b6d7e9579996968bac0b8d2d4cc4a121c43a114c48b9fa799fa6
-
Filesize
128KB
MD503ac10b9c42d7655a7d2daaebfa426f6
SHA18392512be52912f6df76b719f281575d1e9b4a55
SHA256263ee797ed818459daf037e8ccb6244cb5c5dc15e2b2e9e883bcb8e916307b90
SHA512038d9ce6cda080c37a35f7dace4822a01ab9c32dc039a6c4ec113fae656a0409e14bbb0ab31a8fa3e3af00457d1938d677dca2a9e3d37bb650cb2f2a3f672354
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd