Analysis
-
max time kernel
24s -
max time network
27s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 06:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://medicare.aublgg.services
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://medicare.aublgg.services
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582402920314204" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1668 chrome.exe 1668 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeCreatePagefilePrivilege 1668 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 4508 1668 chrome.exe 88 PID 1668 wrote to memory of 4508 1668 chrome.exe 88 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 1964 1668 chrome.exe 89 PID 1668 wrote to memory of 3368 1668 chrome.exe 90 PID 1668 wrote to memory of 3368 1668 chrome.exe 90 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91 PID 1668 wrote to memory of 1248 1668 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://medicare.aublgg.services1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffedaffab58,0x7ffedaffab68,0x7ffedaffab782⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1824,i,10049370239404116867,17471078844633015774,131072 /prefetch:22⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1824,i,10049370239404116867,17471078844633015774,131072 /prefetch:82⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1824,i,10049370239404116867,17471078844633015774,131072 /prefetch:82⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1824,i,10049370239404116867,17471078844633015774,131072 /prefetch:12⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1824,i,10049370239404116867,17471078844633015774,131072 /prefetch:12⤵PID:4224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4252 --field-trial-handle=1824,i,10049370239404116867,17471078844633015774,131072 /prefetch:12⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4448 --field-trial-handle=1824,i,10049370239404116867,17471078844633015774,131072 /prefetch:82⤵PID:3528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1824,i,10049370239404116867,17471078844633015774,131072 /prefetch:82⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD542583dfc5e2442611f3a21f7c74a5669
SHA14557e5e393047e75f873ad3c271ac9370321db8c
SHA2562baa6fd7c034ce5052721922b2d168e8380aecdac978b8ea7f6956f864831082
SHA512a7bd113e9a377f7e9ec8d9885626ce5700e811cb84bcb6b9068c1af474a222c6a3d3d094db03877ed2bcbc204297ab3fe0fae687d01b18ecb3d2e74fd0ff1665
-
Filesize
128KB
MD59e39c2463371ddff6e1f948d9a983dd9
SHA11dc96c9c7c5c3895b996cdee063487d6c33f7ec8
SHA2566e24915c3e04d6478c6c4674c24361f2b7646ea65da0b0f3a391d98476d6be6b
SHA512505cdd1abb40e34eaabab13af7cfa9cb4e95c0891ac801db8ddd87baccb2468952928a348e1dc3d22a95e31caaac37e6f25461b41ee12f56f80689d41a8dee52
-
Filesize
128KB
MD563b2c16848085527708fd3b94aa7bfb4
SHA1babba298c1422d80f4e7c971ef929bb253cf5bc6
SHA2562b68f80afff9c3185c0f6d0b3a7dd75b09a17bc93556cd8bbb8fc148fa838f6a
SHA512c449d6f471f1c0fc7b0a6fc7a4ec09489eeacee9642bd1d452dfdb335a2be40efb04ccb03e7e9f8fb17f51baf796bbf84aa74f70d2dcb9d6341c1e3e5793ea73