Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 18:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://track004.clientify.world/f/a/P8tX_sAE3zQjeVTFNTT0TA~~/AAArHAA~/RgRoCQ_5P0RsaHR0cHM6Ly90d2l0dGVyLmNvbS9lYWN0aXZhbXg_dXRtX3NvdXJjZT1jbGllbnRpZnkmdXRtX21lZGl1bT1lbWFpbCZ1dG1fY2FtcGFpZ249aW50ZW5jaW9uZXMtc2VnbWVudGFjaW9uLWVkVwVzcGNldUIKZh_9iiZm3-Ej_lIYanVhbi5jYXZhem9zQGxvY2t0b24uY29tWAQAAAX5
Resource
win10v2004-20240412-en
General
-
Target
http://track004.clientify.world/f/a/P8tX_sAE3zQjeVTFNTT0TA~~/AAArHAA~/RgRoCQ_5P0RsaHR0cHM6Ly90d2l0dGVyLmNvbS9lYWN0aXZhbXg_dXRtX3NvdXJjZT1jbGllbnRpZnkmdXRtX21lZGl1bT1lbWFpbCZ1dG1fY2FtcGFpZ249aW50ZW5jaW9uZXMtc2VnbWVudGFjaW9uLWVkVwVzcGNldUIKZh_9iiZm3-Ej_lIYanVhbi5jYXZhem9zQGxvY2t0b24uY29tWAQAAAX5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582828776386545" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3668 chrome.exe 3668 chrome.exe 1592 chrome.exe 1592 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe Token: SeShutdownPrivilege 3668 chrome.exe Token: SeCreatePagefilePrivilege 3668 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe 3668 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3668 wrote to memory of 4536 3668 chrome.exe 86 PID 3668 wrote to memory of 4536 3668 chrome.exe 86 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 4876 3668 chrome.exe 87 PID 3668 wrote to memory of 3828 3668 chrome.exe 88 PID 3668 wrote to memory of 3828 3668 chrome.exe 88 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89 PID 3668 wrote to memory of 1656 3668 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://track004.clientify.world/f/a/P8tX_sAE3zQjeVTFNTT0TA~~/AAArHAA~/RgRoCQ_5P0RsaHR0cHM6Ly90d2l0dGVyLmNvbS9lYWN0aXZhbXg_dXRtX3NvdXJjZT1jbGllbnRpZnkmdXRtX21lZGl1bT1lbWFpbCZ1dG1fY2FtcGFpZ249aW50ZW5jaW9uZXMtc2VnbWVudGFjaW9uLWVkVwVzcGNldUIKZh_9iiZm3-Ej_lIYanVhbi5jYXZhem9zQGxvY2t0b24uY29tWAQAAAX51⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd96baab58,0x7ffd96baab68,0x7ffd96baab782⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1928,i,7707738067258401810,2932509868238847871,131072 /prefetch:22⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1928,i,7707738067258401810,2932509868238847871,131072 /prefetch:82⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1928,i,7707738067258401810,2932509868238847871,131072 /prefetch:82⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1928,i,7707738067258401810,2932509868238847871,131072 /prefetch:12⤵PID:920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1928,i,7707738067258401810,2932509868238847871,131072 /prefetch:12⤵PID:4044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3520 --field-trial-handle=1928,i,7707738067258401810,2932509868238847871,131072 /prefetch:12⤵PID:1416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4468 --field-trial-handle=1928,i,7707738067258401810,2932509868238847871,131072 /prefetch:12⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1928,i,7707738067258401810,2932509868238847871,131072 /prefetch:82⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1928,i,7707738067258401810,2932509868238847871,131072 /prefetch:82⤵PID:2524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=736 --field-trial-handle=1928,i,7707738067258401810,2932509868238847871,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1592
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f8c4c233fa5ca303e3bb3450039c26b
SHA180c647875cefad324e10fffd6a0a3b16d6b5b680
SHA2566aa3f4b7a677e129da2a9bce7189e3f751764b0b5f3a35f1e5b1ed4f248413c5
SHA5129ccbc25497e48fdb1e10353b81aff01849e753755e6615e940bb2a20bd58c96f237d14764cec88ad2bc8c28d2ce00430c300c844847508191d411ec05402962c
-
Filesize
2KB
MD5cbaec7ce3fe2bfd4ad9c2570b9754bbe
SHA16624a535db0f615554819d4b29576e734cf0ae18
SHA2560f9d4d9b1de56777832cceeecf50ea69e656b5cec3893215d8b1f6fbf4ce778f
SHA512de33277debe62394447f08e98f06e8211dab895e6537d682d3612ef9cd247b35e1da3af9ec7cacef4dc19ff7e74beb0a6061ecfefb60b9b70e467e240bcfe3a1
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5bad51dae286b8dc19b41881ea423822d
SHA19deed5460e1bb302ec2973c4dd6769de7bbde340
SHA25654c9102b3af0e863a8c9de26387d69f03084ef35f70b1fe67cf778e831e44efb
SHA512bccca388ad0bdbe7fa53e6c75a1829609c666ba21318eda78fcedcc152262f5e1efa47e644700803c848e44db21b5e2a19ebc0af4b6e12ff212c549e318fe156
-
Filesize
1KB
MD57a6aaf1653a907cd93baa74c77672a3b
SHA152d5b71ac9d1d5889153a0fc2c16ba0f2b417241
SHA256bf9d9a2d8de4a269b4abcf1401875d73e44e21a0d3882fece2eda94f144992b9
SHA512c5e2f0ebf7539141b771052554c7aa69831cad4aebf4696167be56e0aab21a3919ac40df7eb9a0802f6e178a1910818b9b2ad23a16ae230866a6b04ecfe5548d
-
Filesize
6KB
MD57775ef414df693fec53104b573377213
SHA15ca1b8abf8ee6946fa7371298e9eb3a5ec29b251
SHA256379c9a24048fde8982c78615ce37c51dd0376ef20326b764f946f83bb582829c
SHA5124d327e0ff3b5c8621d404238fb558482709344e1376cdc310c03217aa59a8538b2fa7a0418013a6e150ccd0c646a1d7a55928fb0b31b6abc5f5512748857b171
-
Filesize
250KB
MD5c08c472494d35a5d8537913353c2d894
SHA1abc6f1e186c35a2e647e0e67b419e6a369bb2762
SHA25684a7bb6a5bc4a6be434212a1d0e58e9922ba299452de3c96500ebdc498c16837
SHA5124295e9dc01c439f9f7d0688cdca89939c88cd566afd7ed635d2ac5bf6c8d9a1b619b3cd76f7d2b30c5712407188f3803f5a533b4fb1dde5a7ab72bb1cd8264d3