Resubmissions
19-04-2024 15:25
240419-strmsagf6v 119-04-2024 15:22
240419-ssc31aff99 119-04-2024 15:20
240419-sq9n7age8z 118-04-2024 20:47
240418-zk7qzaff9x 718-04-2024 20:36
240418-zdn1aaec33 7Analysis
-
max time kernel
60s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 20:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://search.saveturtletab.com/search?p=hello!
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://search.saveturtletab.com/search?p=hello!
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
https://search.saveturtletab.com/search?p=hello!
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
https://search.saveturtletab.com/search?p=hello!
Resource
android-33-x64-arm64-20240229-en
Behavioral task
behavioral5
Sample
https://search.saveturtletab.com/search?p=hello!
Resource
debian9-armhf-20240226-en
General
-
Target
https://search.saveturtletab.com/search?p=hello!
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133579466422762967" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2624 chrome.exe 2624 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeCreatePagefilePrivilege 2624 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2624 wrote to memory of 1968 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 1968 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 4888 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3572 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3572 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe PID 2624 wrote to memory of 3024 2624 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://search.saveturtletab.com/search?p=hello!1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc958bab58,0x7ffc958bab68,0x7ffc958bab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1872,i,4345550860468843358,541734953613327191,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1872,i,4345550860468843358,541734953613327191,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1872,i,4345550860468843358,541734953613327191,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1872,i,4345550860468843358,541734953613327191,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1872,i,4345550860468843358,541734953613327191,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4220 --field-trial-handle=1872,i,4345550860468843358,541734953613327191,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3300 --field-trial-handle=1872,i,4345550860468843358,541734953613327191,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4456 --field-trial-handle=1872,i,4345550860468843358,541734953613327191,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4092 --field-trial-handle=1872,i,4345550860468843358,541734953613327191,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD560da126d1277ba7e3cda4ad60f7cdb7e
SHA152289b91e33473d8838b43edb0c2657bf0f15340
SHA2564f508caec218dc2bcaa48c545506bc51f23a5abd2b330bfb895f329f2c376d70
SHA512277b029cfdd33421e6b85159aee16145b9e7d58390ed90f4c32c5fe904d44e7262bb56659126883e8d18bca77538cea37a8a8a8f3f8d8c4e8697a380471606c5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
250KB
MD5241b4ca7ca81c5e0b9fbe908770e68f7
SHA132fa519ec7417a365e358298681f39108a19ec80
SHA25657888189bb14d0c79b66b855aadbe0e3bf9419fef3beef21c3e976931017da05
SHA51255e5abf1d6fad150ab9485ecfb0e96cdcb1c1bf3e38b9b77c412b8e91cdb3cba517cac023701843eec7aed59168f0b4fca77d0dec47578901dd5617f64cdcf36
-
\??\pipe\crashpad_2624_ZQKTSKZYAHRBUBGTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e