Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 13:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dpdneitaddrvv.top/hu/
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://dpdneitaddrvv.top/hu/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133581789641742567" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5044 chrome.exe 5044 chrome.exe 5088 chrome.exe 5088 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5044 chrome.exe 5044 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe Token: SeShutdownPrivilege 5044 chrome.exe Token: SeCreatePagefilePrivilege 5044 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe 5044 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5044 wrote to memory of 1492 5044 chrome.exe 90 PID 5044 wrote to memory of 1492 5044 chrome.exe 90 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 64 5044 chrome.exe 91 PID 5044 wrote to memory of 2164 5044 chrome.exe 92 PID 5044 wrote to memory of 2164 5044 chrome.exe 92 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93 PID 5044 wrote to memory of 1664 5044 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dpdneitaddrvv.top/hu/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ffcea73ab58,0x7ffcea73ab68,0x7ffcea73ab782⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1608,i,5615353363267768744,4178252234966822517,131072 /prefetch:22⤵PID:64
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1608,i,5615353363267768744,4178252234966822517,131072 /prefetch:82⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1608,i,5615353363267768744,4178252234966822517,131072 /prefetch:82⤵PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1608,i,5615353363267768744,4178252234966822517,131072 /prefetch:12⤵PID:3792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1608,i,5615353363267768744,4178252234966822517,131072 /prefetch:12⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1608,i,5615353363267768744,4178252234966822517,131072 /prefetch:82⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1608,i,5615353363267768744,4178252234966822517,131072 /prefetch:82⤵PID:3740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2556 --field-trial-handle=1608,i,5615353363267768744,4178252234966822517,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5088
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6b655ef8-bc5b-4fb1-9603-f4e387a1f044.tmp
Filesize7KB
MD519af97d3221375f8cdf2c0c7842c54f9
SHA17bb2bb9dc06fbd80ea6a292c6ffab86ec1ea0933
SHA25645fb5c28d27d461103d8f670aa801ef5eac77c15dfcc1f4da350e76e364b4621
SHA512b430562796637b3ec968416d8154fbb969f238882a220fa7ea2e831f0e5f2ca3b57838002f4ad55e8288ba4d889e6698b2bd17629e697dc781d3589a32312f50
-
Filesize
2KB
MD544197b2dae56666aa8885d9ece7d560d
SHA172453c1cd7a696df11486e540cb9bc5db4a8f05d
SHA256bcad84df8862d98441c42686e3e15862a3c3d77a608b35b8e79ea7944e3030d4
SHA5122c1750537c307646dede5d830d019be964201a6c061c80291ebe608e565e5618eb19e169eb8b0c359a3c37d1415d200f00f61a23c218fea23f0f1dfdf449e575
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
250KB
MD53aaa742f841c0884b6615248616989ed
SHA1a7e64aab30cd4bbd04023f30a403c9d97d950452
SHA25611b10f569506d0ef7f8a0f2bee7396803ae1fe81763dc4f391b01b6ce7679b23
SHA51252635a7bcd646e3ad45d2f0a2d8457e7182070b9f2d53256a67191924ef539d1772913602b75e711a184c8ee846a8997aef98d8ab117614bf649b6ff1f73ed8c