Analysis
-
max time kernel
600s -
max time network
600s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 04:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cPtGB04.na1.hubspotlinks.com/Ctc/2L*113/cPtGB04/VWZsp228WfM4W375gfd3q1rDwW3kyKQV5dFj23N1PJbts3m2ndW6N1vHY6lZ3kSW5fN6812SvJq7W3mGrdP7VHN1TW3pN0FL4p7lDXW4Xs_GL2lMjmtW3ptX3k4vCMyQW4vJ6pq4DN3XDW9hmhjD4wlxbjW68f5TC5HtqpSW4d5SSX4xXR6YV3WLSY8fmH10W1kDbf52KL1y0W8qhRxs4RCvNxW2xD134196RDgW6ml3Xh6Pwy3YW5gqfdV682XvXW5qHqNX7jt
Resource
win10v2004-20240226-en
General
-
Target
https://cPtGB04.na1.hubspotlinks.com/Ctc/2L*113/cPtGB04/VWZsp228WfM4W375gfd3q1rDwW3kyKQV5dFj23N1PJbts3m2ndW6N1vHY6lZ3kSW5fN6812SvJq7W3mGrdP7VHN1TW3pN0FL4p7lDXW4Xs_GL2lMjmtW3ptX3k4vCMyQW4vJ6pq4DN3XDW9hmhjD4wlxbjW68f5TC5HtqpSW4d5SSX4xXR6YV3WLSY8fmH10W1kDbf52KL1y0W8qhRxs4RCvNxW2xD134196RDgW6ml3Xh6Pwy3YW5gqfdV682XvXW5qHqNX7jt
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133595307189394341" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4844 chrome.exe 4844 chrome.exe 4936 chrome.exe 4936 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4844 chrome.exe 4844 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4844 wrote to memory of 4344 4844 chrome.exe 91 PID 4844 wrote to memory of 4344 4844 chrome.exe 91 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 5096 4844 chrome.exe 93 PID 4844 wrote to memory of 2480 4844 chrome.exe 94 PID 4844 wrote to memory of 2480 4844 chrome.exe 94 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95 PID 4844 wrote to memory of 864 4844 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cPtGB04.na1.hubspotlinks.com/Ctc/2L*113/cPtGB04/VWZsp228WfM4W375gfd3q1rDwW3kyKQV5dFj23N1PJbts3m2ndW6N1vHY6lZ3kSW5fN6812SvJq7W3mGrdP7VHN1TW3pN0FL4p7lDXW4Xs_GL2lMjmtW3ptX3k4vCMyQW4vJ6pq4DN3XDW9hmhjD4wlxbjW68f5TC5HtqpSW4d5SSX4xXR6YV3WLSY8fmH10W1kDbf52KL1y0W8qhRxs4RCvNxW2xD134196RDgW6ml3Xh6Pwy3YW5gqfdV682XvXW5qHqNX7jt1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaee4a9758,0x7ffaee4a9768,0x7ffaee4a97782⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:22⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:82⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:82⤵PID:864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:12⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:12⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:82⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:82⤵PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2908 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4936
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:4520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:3892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
569B
MD5a0541e197917cebb5de715918f673bcb
SHA145a9f6728f34662cf44040b45f176f0007f76cd4
SHA2560808fa46865e6ca0f4d0d563dbe55562f8ee2fb731e1845316d71cfb2bc7eff8
SHA5120ccf916cca1c083bade30dea128279d45a6d6e8c3e5e58ae826d8b42c7b7bd96eecad11ef5bb56f3644cc549e768d691b66b394e3e730b0cca751d21e70efd04
-
Filesize
986B
MD5d6b4beecf60f75c8a77094877afb8ca5
SHA1e548e36c42e63eb35729a398b12847df8697294d
SHA25651992c9b16b7f2e510679ab2d56af3860f6865ca5f7a1354784271176aca2bf1
SHA512b8e68b57c0b579987d8825527ee2659d72f176cee478f54d8101265a8bd7d79c9fde383eb604c9faba76f422e6a7499dec0a52d54709fcd6d5c376924eaef753
-
Filesize
6KB
MD56b4f0a772c9662f298253f98a726ee2c
SHA1709bb3c91638d3c70a9a942be0bd2bd6ffddd182
SHA25668078a1f122db0a196151fb79d5f0c846dbfe58cc34e20f71d836bb123cc59ee
SHA5126864e41401c22156fff09a000fdc0ab2628130461f4d4c8c4558ec493bd69a95734e861dcc2e8f41f8f4db69855167c817a87f2d3d0258dd85317e7e1bd1625c
-
Filesize
6KB
MD5705fc0cbca6e9cc615a3e1125b961e17
SHA1dddc83eb3be0e8602933134b7aed1d1c9cc533ba
SHA2568d184592faf1edce12516e01ad162f3c8d8269dcdc8e847ef4dad2e6f7ee2ec3
SHA5128e01ba8181029e3d67b61abf2f0ff336874784a24f4324d4ac62f5beebf4b123c56db65733578d1e1d7e9ef0ae49ebca99d1807cdc503e6489e6a2fc0130b303
-
Filesize
6KB
MD5b18fc587eee6e848e8f980cddbc363d1
SHA10fc5fcfbd66a5c877cd1c01f4038317ac7ba615d
SHA256c1212ffc5f4f2c6d4202ed81b90d4e3a6e3aeb342e9b9d52ff9ece37b76c35ae
SHA5123932cd31b0609fdb1b76c7321dd974a7ac5c862230490e6765e6649a8f6307a81ff9702373fbe9a233b12c8fcdef6294740ca9d51cd7ad0a5daf16397b981c1a
-
Filesize
128KB
MD57afc1c2014eab48a3903a89e5db1f4d8
SHA18180486fab3b47df7df40a5363681fc7c34d26d9
SHA2562a504b8aa9e789ee51a5c471cebd93c3aa82a87d16a1a6da77cb29dfd2fc36e6
SHA5125cf20abc041a9490aec128e5ef4c5778e24b0e91dd1322a115c32042395e07bc71f8dc35e37fced09cd9c6ba47b90aa1913903b89531d82a81d4aaa52c372189
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd