Analysis
- max time kernel
114s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
19/04/2024, 14:04
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
- Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
flow ioc 27 https://www.manageengine.com/cookiepolicybanner.html - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133580090628554621" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 688 chrome.exe 688 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 688 chrome.exe 688 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe Token: SeShutdownPrivilege 688 chrome.exe Token: SeCreatePagefilePrivilege 688 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe 688 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 688 wrote to memory of 1132 688 chrome.exe 85 PID 688 wrote to memory of 1132 688 chrome.exe 85 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 2400 688 chrome.exe 87 PID 688 wrote to memory of 3296 688 chrome.exe 88 PID 688 wrote to memory of 3296 688 chrome.exe 88 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89 PID 688 wrote to memory of 2944 688 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.manageengine.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff993cdab58,0x7ff993cdab68,0x7ff993cdab782⤵PID:1132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1876,i,4594872408942834940,2285024676299148723,131072 /prefetch:22⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1876,i,4594872408942834940,2285024676299148723,131072 /prefetch:82⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1876,i,4594872408942834940,2285024676299148723,131072 /prefetch:82⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1876,i,4594872408942834940,2285024676299148723,131072 /prefetch:12⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1876,i,4594872408942834940,2285024676299148723,131072 /prefetch:12⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1876,i,4594872408942834940,2285024676299148723,131072 /prefetch:82⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1876,i,4594872408942834940,2285024676299148723,131072 /prefetch:82⤵PID:456
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 8246ca25451de3cb846a847d658039cbda18ad38793effb6a77e512db94f91c2
- MD5 21a0867448b670afdfbc024ef4a47a8b
- SHA1 dbb8279bc297c363a07610243c38f9d944bd409a
- SHA512 68cc756aa31cd6c8f5638b2b8deff7c88f4e508ab1a68d32563895b705af7671111ca7886ed952c95827a84bf7e480f8e3c0099af2e0849c87fa6927aa01767d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 30936c666929e0239f07e3c5c1682d26db197ddde26b4ad422ddb33ff99183a7
- MD5 3ab148af6ff8d542301d9d3620d69f06
- SHA1 0bd5186fd893e661a5fa719ccff9643a077c3985
- SHA512 f7e8cc565f9156ae93972f0c72e3614cfe88b51c8ca116636c3fbaccec5a7313dbea8815afda754dbb185839e651bf138ff58755d7210ff107656b513fc06300
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 860B
- SHA256 2389a3cf973e1842eb042ab1b86650cc23293716fe6a9544de06462bb3d8c591
- MD5 f1ed01e1d5e81b3a412ca37f5b0b2582
- SHA1 46c984b9ac44e5382466b3a04a10661cdd11f4d2
- SHA512 29e5f3a86008ef8478042095b536c8eefe3c106b61083488922160c62ef23315a84ca3784b6bfe12a05651bf5caba64302233ecc2c5d913d994f53e0ae0c2406
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 860B
- SHA256 2b6836a65414ce0b0a12eaa5ff829f5ed8864f4d4f1014b7aca12b40155ebe53
- MD5 6da6b189c6219e901e6540f0b0425e7a
- SHA1 7dc11f847629b4cf5bf3eef99ed66c17618f384e
- SHA512 f4720effc3e6502c5ec899a2d07e5a37c280e7215b23fe72de09726aa9b93b4a834195167f7b741729617cc0511dd8e53089846c8604b6169cf8c6c68e119ba0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 860B
- SHA256 4121ad3fb0ff70bf25b6b810ea82cd1a5b14328cba57c0bf12f485b1da96f61c
- MD5 9e8f3dd2bf11715927338bfc112ce7e2
- SHA1 4c4b29ee3987ebc8075bdd1bd72273656743fcfd
- SHA512 25f9e17dd6300be83d74985480bc623cf73fb788b0dde8834ffe2740fd40eb0b626c3f277c5707694fe01cd9151ca56131da32e5a6a103489e67269389876e41
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 860B
- SHA256 7145cab15c7b0183ff8dc490b5168182a9c4f73b18e9b30fb21a8b80d6644a5d
- MD5 8ea7e68a30b56e10aa7a1e7003fa8aaf
- SHA1 2052349e467fb21600b255b0b50dcbe4fe3fb408
- SHA512 8b614a3e1c45ad2e7bf2b0edb0d9409e3f6cefbf723c67bdd497dfcd566d7f4349c424a9808335b67608d95c09ee5e6f3ad4181dbf822684a3efb4b234876890
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 860B
- SHA256 68644fe8ba576f3c96ddbd3aa5946b8f9b0c65bcf05d1f8826f6b4f4170a2208
- MD5 84b6ace07548658bafd4d79371fa25c5
- SHA1 38f35d0cad6e8a1757df77095863b9dc2eecd700
- SHA512 bb7f21b6cbb541784c355afc7b1014567c83b1bc6bd3e53a1f7617cc0dd2fea85ee08eafbcffb8546c4201e3b692ca85aa92078d93b646fd6f92d913b4bf3112
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 7ecbfb450dd52887b651e7cd36c91be891da71e05db2cbc4746232cc26b55a87
- MD5 76fe08f1c521fc1e6773a38bbc9ed27b
- SHA1 77bd13a801ae125431b81e42c4382c2727a34078
- SHA512 0c93e0aedaf43dda0e7f51db94f607db110d89833ce3475e3116592ca4094669f042762c7681009eb9a036b92a5ba84282acb90a469eeea6f220249d1fae7aba
- SSDEEP 192:REqbG7WGMqjoaJw8syh+FMvI+CbeoP5tjEsXtScR:RRtBqVKyq2I1bHtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 127KB
- SHA256 64a7b70152bef37c16e4e4929cbbc8b5de9c9cb753baafc76425f75f148bc26a
- MD5 d442e27ddad7f3887303329efa762850
- SHA1 f7e55b3271360d4ce2809eeba9aae74dba4b6599
- SHA512 68a2e23dedd692dcf647ffaf24070b13bea85ae2ac3d4a5ec1cb846f30266e170ba3265caf6c1885e0ad66d9403c9461d05e22db3f79c850cff247220c9ca28f
- SSDEEP 3072:iuu4KTSgReMdM6eGiecFn5jq1ca7sBLzwevIonvRbrS1TC:iuu8oeMdMqCFn5jq1987IGvRboC
- MD5 SHA1 SHA512 SSDEEP