Analysis
-
max time kernel
52s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 12:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://RM.SMARTSHEET.COM/VIEWPROJECT?ID=9210913&UTM_SOURCE=ENS&UTM_MEDIUM=EMAIL&UTM_CAMPAIGN=NOTIFICATIONS%20%26%20DIGESTS&UTM_TERM=DIRECT_NOTIFICATION&UTM_CONTENT=PROJECT_LINK&COMPANY_GUID=3A6DF6AF-F8C0-49FF-B8B6-BCBD6ACF93CE&USER_GUID=08B3ECF9-9D66-4D72-AF53-B337CA7AFE0C
Resource
win10v2004-20240419-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://RM.SMARTSHEET.COM/VIEWPROJECT?ID=9210913&UTM_SOURCE=ENS&UTM_MEDIUM=EMAIL&UTM_CAMPAIGN=NOTIFICATIONS%20%26%20DIGESTS&UTM_TERM=DIRECT_NOTIFICATION&UTM_CONTENT=PROJECT_LINK&COMPANY_GUID=3A6DF6AF-F8C0-49FF-B8B6-BCBD6ACF93CE&USER_GUID=08B3ECF9-9D66-4D72-AF53-B337CA7AFE0C
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133589548208886494" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4084 chrome.exe 4084 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe Token: SeShutdownPrivilege 4084 chrome.exe Token: SeCreatePagefilePrivilege 4084 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe 4084 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4084 wrote to memory of 3728 4084 chrome.exe 84 PID 4084 wrote to memory of 3728 4084 chrome.exe 84 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2596 4084 chrome.exe 85 PID 4084 wrote to memory of 2600 4084 chrome.exe 86 PID 4084 wrote to memory of 2600 4084 chrome.exe 86 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87 PID 4084 wrote to memory of 2132 4084 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://RM.SMARTSHEET.COM/VIEWPROJECT?ID=9210913&UTM_SOURCE=ENS&UTM_MEDIUM=EMAIL&UTM_CAMPAIGN=NOTIFICATIONS%20%26%20DIGESTS&UTM_TERM=DIRECT_NOTIFICATION&UTM_CONTENT=PROJECT_LINK&COMPANY_GUID=3A6DF6AF-F8C0-49FF-B8B6-BCBD6ACF93CE&USER_GUID=08B3ECF9-9D66-4D72-AF53-B337CA7AFE0C1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff8556cc40,0x7fff8556cc4c,0x7fff8556cc582⤵PID:3728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,1049376311284699326,6268179014485276197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1876 /prefetch:22⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,1049376311284699326,6268179014485276197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2184 /prefetch:32⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,1049376311284699326,6268179014485276197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2460 /prefetch:82⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,1049376311284699326,6268179014485276197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,1049376311284699326,6268179014485276197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4624,i,1049376311284699326,6268179014485276197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4632 /prefetch:82⤵PID:3108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=5056,i,1049376311284699326,6268179014485276197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5072 /prefetch:12⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3208,i,1049376311284699326,6268179014485276197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4412 /prefetch:12⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4924,i,1049376311284699326,6268179014485276197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:996
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:2052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5109e3239f8ca022e1bce9d93a017ffb6
SHA1e5dbb91cb0fea1491de3ccfb59e1480ce9bb0641
SHA2561b0694d0a194fb6330f95f82a9178ae58530b00915a5f088ef13484b6d17176b
SHA512ef473448cb32a06ce0c1452dd80aaad76878047cc92207fd190084aad54c914020a9976de54d7298b3a20fd9a939f12edc493be4fdaa087a7e11668fe1a26381
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
8KB
MD56102bfe8fcbf9eed2eaf272672d4666a
SHA1d4d957501fe5737d06a33769528774d35df002e6
SHA256bce0db0960ad3305f42d745e1fe8def0e83f88181d0d86a8c9529369c70dceda
SHA5125f0b8790c3db4c04b9bd2f4becaa4728b8bd12977411b73c8cb53a7ee727e03409b9824c94abcf88b57000d6ca35ef3e32e22b0df151ff0b186cc32eb2b57ef8
-
Filesize
9KB
MD53c77d5469becb62109f4a4000312c6ce
SHA1b6416209c8c105f5b0da7aaedf8324b1b1e168b6
SHA256dabb2ffc337e0dc322d810b70b09eb431efe0d46b66c77ef1a581248e278d16d
SHA512a2416ee2dfc3af11f2c19f2c2f9a39b4ef7ef1a75e4c6a8934ba17815fbeb04708ea55a672caaf4701189ecabbce6184aa25804e73f406ed469dcda45d455f07
-
Filesize
9KB
MD53a7cf439ea70a04d7f65be2a05f46610
SHA1b9bc89759ff960086739b8069bdec100f9b8243b
SHA256e0d68c100bc1efb8a629bc95bdfd5e11b1693ffd546f359e60d4f6f035abe517
SHA5125b2df69bbb2d2a58caa6541da3492d742e4ef1ef1dbc37240a91c327663557827cbc5a3ef42f5bc05252cb86d1b53bb9738004d89e973d4ac773ae73edf42997
-
Filesize
77KB
MD524e26c428fa8127f9136b56ceac1a674
SHA16c4800160934345df97488097e67ca5d6d3b4b17
SHA25662e2790df12a35a9dc60152ae808390f7695b79be4ffcd2e7c5136d2b38acc64
SHA51237ee34ede978c080793f4eff5a698ae68e882238c068246314c5167bd1bb1077963e31cd166606b6214f466d70b66b500e0b9de9ddd78f2b02cbad3b36ca5aa1