Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 16:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://click.email.sportsline.com/?qs=90c484179f940158ed6a5974567adfc3e5601ac03f9368c260e6a57b1e861fc1e62a60bad50d9cbc15b3a78438a8bf5e4ec8039ad39a5aead2ff3eca99309cb7
Resource
win10v2004-20240412-en
General
-
Target
https://click.email.sportsline.com/?qs=90c484179f940158ed6a5974567adfc3e5601ac03f9368c260e6a57b1e861fc1e62a60bad50d9cbc15b3a78438a8bf5e4ec8039ad39a5aead2ff3eca99309cb7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133577596281064942" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 888 chrome.exe 888 chrome.exe 2012 chrome.exe 2012 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 888 chrome.exe 888 chrome.exe 888 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe Token: SeShutdownPrivilege 888 chrome.exe Token: SeCreatePagefilePrivilege 888 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe 888 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 888 wrote to memory of 4560 888 chrome.exe 84 PID 888 wrote to memory of 4560 888 chrome.exe 84 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4812 888 chrome.exe 85 PID 888 wrote to memory of 4700 888 chrome.exe 86 PID 888 wrote to memory of 4700 888 chrome.exe 86 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87 PID 888 wrote to memory of 4468 888 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.email.sportsline.com/?qs=90c484179f940158ed6a5974567adfc3e5601ac03f9368c260e6a57b1e861fc1e62a60bad50d9cbc15b3a78438a8bf5e4ec8039ad39a5aead2ff3eca99309cb71⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc62e8ab58,0x7ffc62e8ab68,0x7ffc62e8ab782⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:22⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:82⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:82⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:12⤵PID:552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:12⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4496 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:12⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:82⤵PID:1768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:82⤵PID:648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=968 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52efb0cb4b167341154572a0eb85505a9
SHA1e7d5364cf48ea2c620b60c8e1097d1b577c44e7b
SHA256551e6a997cb620df3bef7bceb36d5757e3e42b12c9ec1e39ae759e4d70f9605b
SHA512e96fe8e375aa57a07c2e9f51b7d1825f90a12233ad41fd0ca0dc09f6aa03dccd6863b39ffe8fa4ab35888f2da6f9a5c72f7d4f17c3931f34a6b1fa89d380edb2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.sportsline.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
1KB
MD5cfb0aaecd553f793fb17d17ec8402790
SHA13409926432a6120ecbb64c8e6a1cca2ecf6e13fe
SHA256d20ba2b2bab6ae211ee19cd21bbe08d8bf05b78b242aab0737d4538768922713
SHA512992c7d84e942ed35170923a392fd3c780372f1fdc0bca60ed8205af96405d400041867aafa1b31c589a4f51c0fb160f204138031542200e0c37ddaf99eefd7dc
-
Filesize
1KB
MD5b844256dbf4eaf4bbf09c45d8d6e4690
SHA1b62a9fccb29a6c194b602ff42d9b701082c9977b
SHA256457973feabbe5214a85edddcf507cb62308b0a13bf7668ed9eddafdfa34014d5
SHA512c3c381a918623468a3b4f75b1467bbb8b7cdc3824d7f0886592546977473bf5c9c025be8f76ffa70dd9687f5a54bdc1c9f7d2329b7ed44359908a420385bd8de
-
Filesize
4KB
MD5cdfb38fc4bafdd0dac1cd32a46a92b94
SHA17229ebc2b9035b22df42a6a616acc2a212b8b144
SHA25600845edf061c1ae57d0427374df6754139f4856ae9e1b5d481d110aa1bfd8a57
SHA5124cb0dfa8e0ec407ffcfababf7f0bfa813bfe5e7b41369e249df5b9e33f8c17d053c7f821ac59373c7d6113e3b6db3413a674adc5d9f2434e42f15c06b42d52a4
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
2KB
MD53ad3daf044c251016ccbf59d6d2f520d
SHA15827f7e59796ae5d483343a27148d5806c905cf5
SHA25690f8d224f9ba1937e8d1ae79574e1493ce66716ce45d83835a75d2a2361e5589
SHA512c9915ec7f922b77d4e1d8d539bc315f3cb41dbc9dcafbb4b0f2c98535605e00993a59b0e76eaa8d06a6807d8de0147a8d0ca94e6fb7ee40835b6356c03cde16f
-
Filesize
7KB
MD525e0608228c40cfc72bc638dd03942c9
SHA193e869533b43cfd5e0a7718ec628ac54408c3bf7
SHA2561375daa83de3ea775fe8cc03fdcb1d9bc356b07b41f4f35557487402fb4a27de
SHA512960611352a93eebb68b53d8eacef6670f5e2b0037d96d43dfc0ce40f125483149b2d59b4862dd00b6077d967cf9739806d3d20a4f801dc8e1cd4228a8c5d03f0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD53eeceb82780ccbc4ca63043520f40440
SHA1879af43380c008a9c1e1b3ecdeb8da1578ff5d75
SHA25679065d074ba21785fc6b1b45e893782f1c4bc2e0ad776303f4511cd37e2adfd5
SHA5123723629f4630f46d2ca07ffc7d0097df99d0c7303cc774df2921b7fed1476962879225b4106e64121c4429488018ff393e32decb001ba1df6ef23237cb5fac36
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ac5d.TMP
Filesize48B
MD55978753cdff00a97aebfb92e5a0bafbd
SHA1f39a9a87883e9ae2ee8b20d2058157ccfbd1cd4f
SHA2566ca162f327157ca7c8d9ffc0d8e531ed0ca564d646049eadf93276e144e15560
SHA5129f8288bf5ada582f9b1bdc70cd43f3205febd90db43f99ff4a0f2c42d4ce589c859bf78a0b8bcbfa63caf189f170ded259027936469d7817630a1b22cb180869
-
Filesize
127KB
MD586ea33d5c79b8cd44ed27151d0a608ef
SHA1f916940d0fae407e73c5eaf7a114c2d7ef94d9e2
SHA2565797e500a640b5d0ef4a796fce71617ae888c03f715cc8150973ca7ca8ded16c
SHA51224c814f4e88a707fb13a0feac069cc723462f4aee2bbecda70108840b0b649535eb46678e69911e120b41acd96e8aee459881d4732e1f1155af45d101c16d5da