Analysis
-
max time kernel
299s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-04-2024 05:32
Static task
static1
Behavioral task
behavioral1
Sample
better-survival-premium-setup.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
better-survival-premium-setup.html
Resource
win10v2004-20240226-en
General
-
Target
better-survival-premium-setup.html
-
Size
39KB
-
MD5
adafd28a62259fd8cf1dfda3b81d0415
-
SHA1
2ff8b160b34ef2ce6ce832f44fcc80fb98370c46
-
SHA256
d0990acd3eec30f007e83ffe47c255b97408c8788a199098f0b448064b727faf
-
SHA512
804674844ba9c5f215d0223967d67b3a8e36f71529deebd19961e8202806bbbec7dc9b2183169eccd3a748a525c2795294bf954000b9ce0f4b91a491805fe9e4
-
SSDEEP
768:IDhbMj16qmboY1/+j2LDyFVr4tasb62G04t+QgIOhql:I+j16qmboY1/G2LDEVr4tasb62G0q+Q/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582376807583488" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2548 chrome.exe 2548 chrome.exe 2780 chrome.exe 2780 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2548 chrome.exe 2548 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 5076 2548 chrome.exe 90 PID 2548 wrote to memory of 5076 2548 chrome.exe 90 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3228 2548 chrome.exe 92 PID 2548 wrote to memory of 3260 2548 chrome.exe 93 PID 2548 wrote to memory of 3260 2548 chrome.exe 93 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94 PID 2548 wrote to memory of 3004 2548 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\better-survival-premium-setup.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa45ee9758,0x7ffa45ee9768,0x7ffa45ee97782⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1888,i,8850069283658633258,10241611701755294826,131072 /prefetch:22⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1888,i,8850069283658633258,10241611701755294826,131072 /prefetch:82⤵PID:3260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1888,i,8850069283658633258,10241611701755294826,131072 /prefetch:82⤵PID:3004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1888,i,8850069283658633258,10241611701755294826,131072 /prefetch:12⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1888,i,8850069283658633258,10241611701755294826,131072 /prefetch:12⤵PID:2128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 --field-trial-handle=1888,i,8850069283658633258,10241611701755294826,131072 /prefetch:82⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1888,i,8850069283658633258,10241611701755294826,131072 /prefetch:82⤵PID:1156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5960 --field-trial-handle=1888,i,8850069283658633258,10241611701755294826,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4240
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:4892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f21102a768a42439ec4be6c1d7a9ba3d
SHA185b8ca4cce73e24edfbe6ca721674cf0c78da559
SHA25630c949db8573cbd0ef94e781b6f6161d44f53ce3e6f4ca7410b5e85a9bffd724
SHA5128d04c893f8bbcef2852fc396ba8ea42f576bcd7fdc434fe6b73bed41aac18b3da9f6a0003549773853ad1565886502c1d2802e0ec385773fb6558444f8f9f5ea
-
Filesize
976B
MD5be538bbe585494ffb1f298aa46014b3b
SHA1634b29999b5d8c9b81daec4b09d032f9f61b44bc
SHA256dc169591b7f38d535cd29198933ea3738639d4759480963177bba8caa86417a1
SHA512be7ad833954899c59f06c993e0840142f852657c9316619c43b8df68150f5c2ee738287f309bbc9471713ea0bffff9e2ee38314a365de935363990d0dcd074ea
-
Filesize
705B
MD590690f8dc5a6373e6a62cf86e935fe54
SHA1010df9496743c3f39ffd35f022ff7c0f9c673cc7
SHA256984bc03091f8b54bd8b920ef687b2396a038e8d19973dbc3ec4487f5acfa6e5a
SHA512004d1e1fdb76fed2d7e3b57df058171cbb36c94324fcebf9f3125da2bc40904c4fe7187b687e5c146cd4b7e0ba29ad791cb3d5090368faafd88aa3c399bc17fa
-
Filesize
5KB
MD5d1efaa706c6ad9fc0f56640453623456
SHA165f048214481381f223a2147eee3efc71c76eef1
SHA2560d535f9dd2d0816bedc3bf5464da82611dbb51f4413a8ed0122d5657760d5108
SHA5123b426360ea07245eb727af4c3c782e525d816c6837d7a7f1076483d192b48ca9f9ad5375e8ee394de86c437a437d38e5c3f25491e9ac638f74d2386ace5c3b17
-
Filesize
5KB
MD5a20135b641dc27ed7d2eaa4cc3ef4f76
SHA12def2cc53fe5adb0e822f74611253658aa45c734
SHA256d9e9aeb7c2b13ab54e6cc48c748045bd2f72dd45e1ae2c9a85dbb23fdc64f9ef
SHA5123ecf690c850c499264999c93d5962adc8413543aa7a181044e791897bb4e5a9f980b5679611deed6e13659af61288686c4c99074345ba92b5722c53dc6f5b1ea
-
Filesize
5KB
MD5062091f3b75bc41a267a8a0712d8b5a7
SHA1dd3f8ad6f74ad7f641d8d45131f95d17dead794d
SHA256de85a245a62c01a1a4e94d2048a04469124dcf5fe8794698f558b2a9364a4a65
SHA512dd5d9102f5c8f2e65e9a740048808bd2e3b3ec3d87e6d1728a34b37bfe21bc0178a28c0bb25bd5a9d876bcd62cf1e767d08c98b4b3e6b795c1f2ba2572c2a3e7
-
Filesize
5KB
MD5f08fa97bd434aefe89d993bea73f7ca4
SHA1d29a1cd6c6c826eae30e6e341aa03b4d5230e403
SHA25667ff187ec5ebfc2801c7a399793db49e42b7419e6aca395ea2e5d22ba34de513
SHA512fdb4ee8f49ec1cfacc783a358ac966f2fe05bd7da5a273c5699a09f92cd2db821785ab232ca51d3d10802989c369758d4bf4ec398f99177326120268b0c15a0f
-
Filesize
128KB
MD565d060dd6086529f5d64ddab2981e5ed
SHA1adbbca473d28d72b22794d59533869a553b5df8c
SHA256539907a3eb8bf2342f458c4037dffe0aea4a7068e83ead9aa373a55db2636670
SHA512a16be361fac72f010b2ce03bdd86bd53478292006ed5416cac3b38cd61d449df46e9d45ba08e14a461d173abe695715b4cecc20b1256224dafa20dd5bcea426c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd