Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 04:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pub-a663bc068e4e4f3eb9ce3a0f257882c3.r2.dev/file.html
Resource
win10v2004-20240412-en
General
-
Target
https://pub-a663bc068e4e4f3eb9ce3a0f257882c3.r2.dev/file.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133583188944017730" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4528 chrome.exe 4528 chrome.exe 668 chrome.exe 668 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 4528 chrome.exe 4528 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe Token: SeShutdownPrivilege 4528 chrome.exe Token: SeCreatePagefilePrivilege 4528 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe 4528 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4528 wrote to memory of 1284 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1284 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 1492 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 4716 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 4716 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe PID 4528 wrote to memory of 3864 4528 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pub-a663bc068e4e4f3eb9ce3a0f257882c3.r2.dev/file.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde1c9ab58,0x7ffde1c9ab68,0x7ffde1c9ab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1892,i,2672170715409827613,12100026174746263557,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1892,i,2672170715409827613,12100026174746263557,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1892,i,2672170715409827613,12100026174746263557,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1892,i,2672170715409827613,12100026174746263557,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1892,i,2672170715409827613,12100026174746263557,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1892,i,2672170715409827613,12100026174746263557,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 --field-trial-handle=1892,i,2672170715409827613,12100026174746263557,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1892,i,2672170715409827613,12100026174746263557,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
120B
MD5355ad57e8f86894531ac92892a3e088e
SHA15fb037adb6eda3280e4da457200492ec32676c37
SHA25661b37fde409de9e5c48ce88eb59fed29384f03a559e5f9b8fb07b44097355565
SHA51228601445e5eb2e2038c1d523d10c57e345c57b92af493c8eb3a900daa5112ba87cebc70e9357e49d45ef8592ac33dc2325f038c4ad0fdfc094818fb72db4a514
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5ca85942cf7702bfb709ef8bdfb921329
SHA1c1d38ba2e80420b5e690e5a678b37804ea4c1431
SHA25634faeccfa1ed8f6b7676f438d116866052179e805236c15a59f6543f911da7ea
SHA512721e1a877f537f3d7b05e9ee0b191bd81b3a37eaf2f850ada1dbfd4933159e2d365c12ad7a70155c24706a655a64885bc65045d6d199c771bd4b7503ff2de688
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
523B
MD5f35aefc733907031ef8847530e8fff29
SHA105e7ad6bdda88d3d6c5b5611f111bc6769ef065c
SHA256ee98f2484f35124bf82b7f36b10f10aa2a5a267dd0de7f922c8ca0c0d70409ea
SHA512ee09d9811a6c1fc5329414ba1a55b33eb52b836c9daaf73db98a2c9e56980c00d149feea561a61d6ff1da9dcf0dfe44325cad6f69667a257ffd714c0bf133016
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD509abadcea63f090d9c5d826e05414092
SHA1377157e9cf940205c4952917610930a6949a419d
SHA256b07a3391e0841a4aac37111fee2d490a73881fc3d8c5a5b0aa5cd063659d9b4b
SHA5127f3220beecee0ac96d20a4d2529b2bc20e6c3ba2aed3618a12c4e2b04e585a1a78092b74bb529c30a227c2158e84a85f944a2bcdd23e27d5375f8c6a17e717ac
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
250KB
MD5156dd15bbe5b761db2c47502170ff3e2
SHA19137205f094db44e62332647b455b074cea6318d
SHA256c33b78d1537fc2c928216cb78290f0942a700563760a643b09c15abfdbdb2aee
SHA512ff046c86cd9ab06867802c943ec1429fcdd69ab2741d5e08d4389140e79f275a4686656bb82cb29fca94399457da5dfea7c45c449a4198581d2e1cac51bd7c06
-
\??\pipe\crashpad_4528_USWLVLCTDIXLQHZRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e