Analysis
-
max time kernel
42s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 13:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ishowspeedy.itch.io/speedymaqing2
Resource
win10v2004-20240419-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://ishowspeedy.itch.io/speedymaqing2
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133589574489983463" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4512 chrome.exe 4512 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4512 wrote to memory of 4772 4512 chrome.exe 86 PID 4512 wrote to memory of 4772 4512 chrome.exe 86 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 1644 4512 chrome.exe 87 PID 4512 wrote to memory of 2892 4512 chrome.exe 88 PID 4512 wrote to memory of 2892 4512 chrome.exe 88 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89 PID 4512 wrote to memory of 4492 4512 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ishowspeedy.itch.io/speedymaqing21⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff99d59cc40,0x7ff99d59cc4c,0x7ff99d59cc582⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1924 /prefetch:22⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2168,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2180 /prefetch:32⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2284 /prefetch:82⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3756,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4640 /prefetch:82⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4496,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4828 /prefetch:12⤵PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3180,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3864,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4808 /prefetch:12⤵PID:1052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4048,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4836,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3560,i,12388269100435071867,6201719361933000183,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4452 /prefetch:12⤵PID:1020
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:2296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD534a82dd064dc8d31fc5ac2ead5e07806
SHA18f142e80b9c394998014f80bc9cb90998ac5d8c5
SHA256857ac3123529302f6550860472dab969e38276dcba61d8ba7e75714dfbb84f3a
SHA5125e28a420609b20aadbc814b2f045d75a78a45a759fbcbd647f11e32a4b423b252c3a4bba223fec98d59b2dee69250aef34926c8872e4b29a1dc8316728fcac08
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
8KB
MD56629fee2a33dd07225ce007a92b9d355
SHA1835b06f1706f73e51ff1afbdd90ba26cff79bec7
SHA2569c32ab5c7e711f1bbbaf86d44a6e832b36c1dc480fb4ada55dfd72414682c2c9
SHA512e77a02b06756e8e3c295e039089fef6b14d0604d94d009e86d59ead4d66ddfd1182789db762ff4a5fb76a5ae794547135285316064ac94f30515b5c446e2eca1
-
Filesize
9KB
MD5668e200bf3ca91ced30767e996e136e9
SHA101b7300b13ac32d2ef8402b4df1f41f8c5b69ab1
SHA256268a9e3bbcbdb1d543dd1f9d8c19b6d294ec28811b5670c9c53d104690507ec8
SHA512769a74b470559175c87847091680bea2f80c927fa46e94159f598e10f3d0d27c4e68584b4d6abcfff84698162e5d54d0eb0db68f1138904bfde4f639be6df7f2
-
Filesize
9KB
MD5f8a8ef8c5a59585e29ed56ec395ce7e6
SHA1147596c36ad9594a6d1571f67e32fc1d69aeee49
SHA2561456f2c4789036a0bee1214fae324db63a2ff2a42259748e0b2dffa3c1283773
SHA51209c2c184e9ed09e67d13a8b1633f79786aee9106f8a555fb3e5b9eb7230a50914cb2585e67829106a5322f64c6fe7c04b3e58058988d89debd09953436fb0c1b
-
Filesize
77KB
MD5db82a70fbefdccc90b8f3aee38adda9b
SHA1cc7fe464f566565c23d7477ffe14611c3ca07d8b
SHA25661358a1f22764d8e6c36433fe11f226d21213ab4a718da4445f32e7a085b9523
SHA512033e92fbb53eb4951105176acc431ce89729bcb233c0d3198aac6a70d5bdfba72cd7c07ae26f814a8dda49b260ad670487b6c5afd9c22bfa9300d89223f9b748
-
Filesize
77KB
MD5855d15c87012dad8829f898a9eaea810
SHA10269332e37cd4172632d809ab8179af191a4c834
SHA2560b51e13446444656481ccb66c0caabf344c8e6354c0b274fbbb482352afd8221
SHA512c3efacb878d67ed6c13143b73ff410ef893445a16320d1c6002e37c1fff1e4800d35c3c7a3adbfb9c2e5411553c7c9ed6da559a5e4a95d4ced40f78ec91b1409