Analysis
-
max time kernel
600s -
max time network
588s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 18:50
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cloudflare-ipfs.com/ipfs/QmcMn1RG1HRvGki5rs2fcaSKehMLcLJT6UqbgLeizH93Xv#[email protected]
Resource
win10v2004-20240426-en
General
-
Target
https://cloudflare-ipfs.com/ipfs/QmcMn1RG1HRvGki5rs2fcaSKehMLcLJT6UqbgLeizH93Xv#[email protected]
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133595849864793277" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 544 chrome.exe 544 chrome.exe 5008 chrome.exe 5008 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 544 chrome.exe 544 chrome.exe 544 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe Token: SeShutdownPrivilege 544 chrome.exe Token: SeCreatePagefilePrivilege 544 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 544 wrote to memory of 4016 544 chrome.exe chrome.exe PID 544 wrote to memory of 4016 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2812 544 chrome.exe chrome.exe PID 544 wrote to memory of 2868 544 chrome.exe chrome.exe PID 544 wrote to memory of 2868 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe PID 544 wrote to memory of 2316 544 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cloudflare-ipfs.com/ipfs/QmcMn1RG1HRvGki5rs2fcaSKehMLcLJT6UqbgLeizH93Xv#[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb017eab58,0x7ffb017eab68,0x7ffb017eab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=2020,i,326105777666525926,5205271758448202265,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 --field-trial-handle=2020,i,326105777666525926,5205271758448202265,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=2020,i,326105777666525926,5205271758448202265,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=2020,i,326105777666525926,5205271758448202265,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=2020,i,326105777666525926,5205271758448202265,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=2020,i,326105777666525926,5205271758448202265,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=2020,i,326105777666525926,5205271758448202265,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=2020,i,326105777666525926,5205271758448202265,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=936 --field-trial-handle=2020,i,326105777666525926,5205271758448202265,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
72B
MD55094ccb002c9b42c9043bcde6e6d49a0
SHA16064098e146ce2c87771e5517235a443c739ce50
SHA2563dceafc2bf4ce23c8feb5667e2f86f192db62688533a2d66c2305f3d563435c7
SHA512c2c26b6c1c4dc2a084248c14226f62037975d352982248413113c669e8fa45b5aa88b01bc715de586c4ba8518c2bb42e0799489a66a85d89841991fe92319c37
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5498045ce93b9a894132453ef8a731bfb
SHA1cca8bed4ac6c990909070836af38a461f6b0b185
SHA256546b392c90a860b450deec07aac3296f435bd3dc142a16fac803c983db2a360c
SHA512f2b37876cf92507ae8f6205748f768f57f8c20ca699523ad419a385cadda9c498954a1a7612bf96b72280a1714f76537de346083532f0f3c1d910856e15e8a69
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5c7ad62b7d9e2e310a6667dbe554dc0b8
SHA1ac9de36efcc8c70cb1e54ac5ebb5ba65286b9444
SHA256224687e7b6f794b4a6f1c22a27372a323dbef65f4b6ca548b2f53f676bd68501
SHA512ce0cfc0e86a3eee0d3617e5790d3d553bf309bed62cebaa605225e88f84eea4c336fc0c652956840194982c579e1552e01d4c8fb94f8e6ec78e54b8961c48fce
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD572782a4797f8f68ee694879dcf8abc8f
SHA11a50902037a791455760fe4ef0ad0741fcee427c
SHA256df7b59e45679e8c2b4650faf6091ac003a769aad37e9359c96633b664b96ce91
SHA512cd22a1870d99416dc08fb6ba0a927027575070b5d5c3e6c117b5cf39a09d2ae10b1985bb05be594b8563ee314371eab88c70302d99f4524c5a9ef4c6b23dd102
-
\??\pipe\crashpad_544_CGEJOQAFVJOTKABQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e