Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 03:01
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs
Processes:
flow ioc 9 http://localhost 9 http://localhost -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133578828981636082" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3400 chrome.exe 3400 chrome.exe 4124 chrome.exe 4124 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 3400 chrome.exe 3400 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe Token: SeShutdownPrivilege 3400 chrome.exe Token: SeCreatePagefilePrivilege 3400 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3400 wrote to memory of 752 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 752 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4296 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4552 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4552 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe PID 3400 wrote to memory of 4448 3400 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://admhelp.microfocus.com/lr/en/latest/help/WebHelp/Content/Download-Help-Center.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffb47ab58,0x7ffffb47ab68,0x7ffffb47ab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1888,i,9009533091870359897,6242963617886086718,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1888,i,9009533091870359897,6242963617886086718,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2176 --field-trial-handle=1888,i,9009533091870359897,6242963617886086718,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1888,i,9009533091870359897,6242963617886086718,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1888,i,9009533091870359897,6242963617886086718,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1888,i,9009533091870359897,6242963617886086718,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1888,i,9009533091870359897,6242963617886086718,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 --field-trial-handle=1888,i,9009533091870359897,6242963617886086718,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
576B
MD5af74fba51ef44ca4dd8f4d69bd76c5f9
SHA19be084c2cc1e376a16c4413ff1772a1b8c195632
SHA2565cdd295fa6607dcbd31832b8d8b0174cba62d2f314a3c2a1ed753273f14db028
SHA512a2145911f2fd5a2e3335502334fd25206ca76ea1f3a841b6087ec423ff0a1aea1106b3dc765ad93749d30e0cc0c61790dc4d827aaefa4a36b2568b8f9239e38f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5025781127390bb6fa544c3735465e786
SHA1a5e08f28aacb1496c63c7945aae5a80dde54567b
SHA256cd61f7f453ff6f1de4d6565f4629ce06dd8dc8bc98a2a71de507b0c64ac44024
SHA51287467aa50cb341f50e885a1956f135bba5bef3f633fb39c6312d4b898ed28d10f7e7ff45ff8bb0df653c94e4b61b84546a09ba1b1ff50646af73deedb5ad7d3f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
857B
MD5a92b85cdf344ec8a67c5486b23a01053
SHA1df2aa16bc62d640fadb3029c6871b5ca39d9bbe0
SHA2569ddedcf57aa0770c19db557ed77b1039136e99d3c7eadc0e1b704aeb3f36ced6
SHA512f0e4b10287bf6fbbe2184cb713560c5c39a8ed9b7c4a26d8662c5a18fa3d8d892876f0f87767ab231565c6952988c8899fc5f45928c898984a1e5567e4f8ff07
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1024B
MD5cb2761878d20511a08aa81d29c0c8fe8
SHA1a8f6250eb59948833df7d793d21a224834aaedd1
SHA256351f8e60b94376bb1733712652af2d297b8b35af3563186f3dc7e08994feda00
SHA51200e140f2832114432ed76a15fed50c801edea563d0af0dcf905bfe1152c000f6daf1c32c8010bc86b0d54234af1af2dc6e8c3e60d425eb891d6a33fa11493435
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD543440a5bada05b238c70522f45e8385e
SHA1014c1e41d5843f79382f8fbf551cff46a59b0499
SHA256f8e574007b3ef17c8ba94a40598c60170e998142b7370172b38109129976d6cb
SHA51204b967b08472b0266eb9089ad02f78193b57575ff8b56c4c3a9cfae7e1d6f5d964f6b964d1bb0283041ac1635374741bc14010bbba752454612ef27b11bff5b7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5f01bbd22aba21573a4187226e2087b24
SHA1dc6bbcedfac714d427ff38617121141f86c3aec9
SHA256b551135741eb8aaadbe5dbc99d4b33bb3351dcb6ff6fdb0346e8595ec9b46564
SHA512e87260ec0e1064e45685d465ea67e9ea872608dea515ab972f070145de72d6130e7ec7769e41784b994cb6e3870edeac271347f6387df10b85edec61e3ec3070
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
250KB
MD537b8136229b59e21449b1830a2871c87
SHA1b98dd3313b22190f698ce9e49fd36f67f631048d
SHA2569a424079b33b975ed002e2c3904f0be12056e120b8e41280b3deb7ded516ae16
SHA5122c5f0347e5876b9ae0aa92b28b9eba9101068386bb4389e3eec8ce3bf1b71970ef716da7d8b7edf38945c7b209f75c39d8e2c07c0c2d194bac6440af33cb987b
-
\??\pipe\crashpad_3400_NDSYYJPPSQELWZOLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e