Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 08:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://procurement.icsmaugeri.it/esop/guest/login.do?qvu=03601887018F38A67CB1
Resource
win10v2004-20240226-en
General
-
Target
https://procurement.icsmaugeri.it/esop/guest/login.do?qvu=03601887018F38A67CB1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133595452527778167" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3620 chrome.exe 3620 chrome.exe 2068 chrome.exe 2068 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3620 chrome.exe 3620 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe Token: SeShutdownPrivilege 3620 chrome.exe Token: SeCreatePagefilePrivilege 3620 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe 3620 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3620 wrote to memory of 5300 3620 chrome.exe 92 PID 3620 wrote to memory of 5300 3620 chrome.exe 92 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5572 3620 chrome.exe 94 PID 3620 wrote to memory of 5756 3620 chrome.exe 95 PID 3620 wrote to memory of 5756 3620 chrome.exe 95 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96 PID 3620 wrote to memory of 1964 3620 chrome.exe 96
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://procurement.icsmaugeri.it/esop/guest/login.do?qvu=03601887018F38A67CB11⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd94569758,0x7ffd94569768,0x7ffd945697782⤵PID:5300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1716,i,8466973839032825496,17658191142695320750,131072 /prefetch:22⤵PID:5572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1716,i,8466973839032825496,17658191142695320750,131072 /prefetch:82⤵PID:5756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1716,i,8466973839032825496,17658191142695320750,131072 /prefetch:82⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1716,i,8466973839032825496,17658191142695320750,131072 /prefetch:12⤵PID:5324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1716,i,8466973839032825496,17658191142695320750,131072 /prefetch:12⤵PID:1152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1716,i,8466973839032825496,17658191142695320750,131072 /prefetch:82⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1716,i,8466973839032825496,17658191142695320750,131072 /prefetch:82⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2528 --field-trial-handle=1716,i,8466973839032825496,17658191142695320750,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2068
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5896
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3904 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:4108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5dfd7b59b857508a2d3f2124ef42bca6c
SHA1766f5a2c90dc9df7ab211354663d1789e4c6fa8d
SHA2562503fe137a7807a1055fa939d0161c991944df425ac7545a0529219804513c93
SHA512e73e906e9e1d751024fcda7dff60404d7df8d9c880cd06078236a9a280f460f1d2040ebbe5ab27e97e1cdcbc0ae37527c359d6894d06742746e3888be9d7c5ff
-
Filesize
773B
MD53e10a8147a25cfa4090733c853de2668
SHA1a9a554514ad8f3eb6b1fb6c4ef12db3bf0a359ae
SHA2566321be5fcc9e8c8ec1c85303999150027b920437b84e48b4cda3bd2a4e3b1f36
SHA5120ac85bedc042cac2e2244b41311c41a81eb539a2c1dd18b43123c04b9272e6da1a8b3de7c42ab742fae4db4bb57d42ad18307b03a42c5a78b913135f1a53007b
-
Filesize
534B
MD52c454258cd1d26adb2d06c8b7af633cc
SHA17793ee876386df16a8a6efdf0dcde905e02c5885
SHA2564988fd44aede909fad24a7222ef4297853553f258d4daa7840beda72608941b5
SHA512e2a2620e82a0882237fb82ea28484d15db53cf6489aac00c9465ce3efc36056f0a864996340419bf93bad1bb557b3aedbe78ae0b3590c94ab26243222662fb78
-
Filesize
6KB
MD517e7d338da0b07242b6e3cd4d7373799
SHA1811d2f6cda7cd1d66d5a252934c2abcbef6c9114
SHA2560fc780508b95630ede231ca5ffe6c0dabf04604229902ee5ba998247fe4437ab
SHA5122026eb2c6ec2c18d3eb5d9db124204fb9d6192324a642c799ee4c6db9c5c31be39f400adb2701ab48d1df2624d50a1a3ddf048f28b3ce7a998f83617c1b6c32d
-
Filesize
6KB
MD50f4d3258fbf929a95140965fb1686553
SHA19110352e6c427cabba85424d42f46d0cd7a3e4af
SHA2562322a87141c07b4d68c7a8454ea26cde7bc971d0c5a731922e4328be1054c7dc
SHA512d0d657cbbc5cd78450a65656bc34cd585bb81c12837356d282c3544c133fdfeff2219bf0e9b367b534705d72055807d779737e3dcfd0df242745d988e2ea7a2c
-
Filesize
6KB
MD58dd36688499c9d564ec8ace83884e12c
SHA1b118a5c41637eb0df4989b2989bdb6a9a32412a8
SHA2560e3fd9d21c9d27eae66c9f084899a9dbc67386fe513247db29f29a9d95b2eb6f
SHA5126cae03cb0fb3e5f8b89e1881b32c6f6e120d7eb13f2bc9ac478b1a09dd7f9a9a2e26f9329dd77b292ca168c104ecbb309b42e01b27552660e1d0d43dda37fb17
-
Filesize
128KB
MD521656f75996bbb2e17ce2e47d8bb62da
SHA17deba6e637dd8fe5b8ed2a331fff810712864602
SHA2568f3d79b026d8d068c2c0144e0ecae8364e745c3947d67629bcc0f2eeb7c5b641
SHA512554cb59e4921ec7e33c992c4abc4f148aaa149e35d5ea2876a355314b11b3d03d2b830d3e5c02b7d678ea9c9e689243978c2c905cd7704ca5cf09d4c8e8da20b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd