Resubmissions
27-04-2024 22:27
240427-2dcncsac31 127-04-2024 22:21
240427-19l18sab4t 127-04-2024 22:19
240427-18w5taab21 1Analysis
-
max time kernel
47s -
max time network
48s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27-04-2024 22:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://loot-link.com/s?o8TT
Resource
win10-20240404-en
General
-
Target
https://loot-link.com/s?o8TT
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133587300040940398" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4212 chrome.exe 4212 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4212 wrote to memory of 2636 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 2636 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3556 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3152 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 3152 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe PID 4212 wrote to memory of 944 4212 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://loot-link.com/s?o8TT1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe56969758,0x7ffe56969768,0x7ffe569697782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1852 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5080 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5268 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5392 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5496 --field-trial-handle=2184,i,17053136602569106464,3699210218278169871,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
144B
MD5b3584d4cb017c11e5b30d4a3cf7d41cc
SHA1e6786fcf90ca5a819e961998dce0ae4880e36041
SHA256bf5dfc41bb66a5c270e276d6c22be34812c57967ee5372213ae75125ad91274d
SHA512dad5a679900b67b762440c45d4ff6d1e8f9e4fc2dcedd14f6aebb577afd83fef5a353e87e517e57a35390e287e229b589d7e0189cb4758504cafea840bc8c506
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
873B
MD5b67ebf024110a022cbd5679efbd0102a
SHA1851cbc4d0214d686802bf447e8babea390205361
SHA25647cab9933ddc07c66a4eec0b3cd2b2c6bd79b49e274964c598d1d6bba3928513
SHA5129dc5a4138162dba95de38af02085dd394229497f5200e0b12b42a8188a2ceb40cc30dace7c00edeee7e7bab86cc00713241a6e7b43119a512808cfdd48e9a634
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
873B
MD5cc21ef86923a62a98a5cf3570703971c
SHA11a398d0a25e05e5fb1f25e359cce5080c020113b
SHA256457fe0de60cf1464471bfbb811f70aaad3404b4370ee256e7a51046bf9b25bdb
SHA512d953a12d1256f1efb510e77ae859c0265706c844ad46dd975511ee373090b4f47fe62a802365bf0fc77297e5b1469d57c75a22946b3963b731fd965b504f376f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD509493b1bede54aa692facc9968590480
SHA179b68664852af553c725e4aebb58617fdf82892c
SHA2561cf9dcb5d6a172209242e877ad9f89bae8f6254119579f048878344e3929fd57
SHA5128544c355bc8cb05e425f63c247b1746c44553670c9feec33fbc05bc03d6544615d1edce440e4fe4613f234613257cab3e2719e2b099c747658a6e84f59f92003
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD53d8dccc9cf65bdae0c70dc1c7c5cc73f
SHA161a78033dd11f686cb791f4a6fff65573fa49bb8
SHA25680767eee77f531972f5cad5855360ed39b717ad4b13cbe63b31b87e5d306e228
SHA512fc1b5857aabc486d93f29c3cf61431e0942ee69eeb874607a32f45d7b1fc415a2e473ed3ea8e734b8ef56d8d7e06f9bfaba21e27fe2939646741a46ebac4bd1b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
136KB
MD5d39d6d1ac84a2969271e3d9d23e8567c
SHA19cdf747915e0491b9735890d8aa631c070ff809b
SHA256cd39a5b2c0e44eba0af2f7c012784f7a9e9735993bd1aed515c973efb708ff5d
SHA51214fddf4791aa59337397d7a829fbfb49a9618e6e178b4fb135d0df83c208da7c316cbb4da50d1a4e20becbbaba45d1d55553b6a9126e352b945473e6901a0c99
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
136KB
MD53ef3bcce448b4185008bff1a1534ebc7
SHA15ad230c1cbe19b65433d9094dc174ed320299a56
SHA256f652e821a510a772b6fcd4992fe979a9b568b097e076cda7b58536c66ba242b9
SHA512cb2e94516450e55f0d2a513a9e3d9be2a025289eaef9360baf70482f0a5b574b66291bdfebea1e201fbe85d350bb4a39e36b928b3b32dd41af846b7719aa679c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4212_NNFPMBNRJVXYTTUOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e