Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 13:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.comar.com/products/?currentPage=1&perPage=12&product=-1&market=-1
Resource
win10v2004-20240226-en
General
-
Target
https://www.comar.com/products/?currentPage=1&perPage=12&product=-1&market=-1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133596481169577492" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4464 chrome.exe 4464 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4464 chrome.exe 4464 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4464 wrote to memory of 3112 4464 chrome.exe 91 PID 4464 wrote to memory of 3112 4464 chrome.exe 91 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3304 4464 chrome.exe 93 PID 4464 wrote to memory of 3296 4464 chrome.exe 94 PID 4464 wrote to memory of 3296 4464 chrome.exe 94 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95 PID 4464 wrote to memory of 4168 4464 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.comar.com/products/?currentPage=1&perPage=12&product=-1&market=-11⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae9d69758,0x7ffae9d69768,0x7ffae9d697782⤵PID:3112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1876,i,3918969382653010342,6895645923494507558,131072 /prefetch:22⤵PID:3304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1876,i,3918969382653010342,6895645923494507558,131072 /prefetch:82⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1876,i,3918969382653010342,6895645923494507558,131072 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3160 --field-trial-handle=1876,i,3918969382653010342,6895645923494507558,131072 /prefetch:12⤵PID:3996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1876,i,3918969382653010342,6895645923494507558,131072 /prefetch:12⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=1876,i,3918969382653010342,6895645923494507558,131072 /prefetch:82⤵PID:1200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1876,i,3918969382653010342,6895645923494507558,131072 /prefetch:82⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5208 --field-trial-handle=1876,i,3918969382653010342,6895645923494507558,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2592
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1680
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:1332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264B
MD507ee96e97afd487d5eb673fcb42262a3
SHA1ddad42af7b065859da2e0ed4c530ccff2987b2bf
SHA256497d03656ebd923adb1fdcf6bfe1a25d126267f45b53228a0a2b724e922a40d3
SHA512586441d46fe78b87b106f0dfec963b89137be8312434d9f6f439071b0aff7f8b2f41511f1425fd2d773b571f00db75041bb4ece694220cda424e28e98a489aa7
-
Filesize
2KB
MD5cddf9acace95ee6e3f1cfe0339f5d1ff
SHA1a03754fb7c792198793e2515197f6a7485a213bb
SHA256785fdf87d3fa3fad5d995d2f31de5dceff11bc629edc5dbf4f6aaa4e5d18cee3
SHA51227cf630834c5ebbf4db86f90fc210abe62f28eaab8e4ac1d104706bf1cd5db040d1dd86a14ff246c95583596512a27b7fc5e5aa3948dbf3acfca00497307c33f
-
Filesize
986B
MD55187deda98cdc4c62d83a23562ba066b
SHA1657b651f96cb13bda07627aa01c16fe675bd4dbf
SHA25683b498fe5561b822be0aa6253b19fc3417ee0ee81087faf882b8c140f2aa4907
SHA5123630f61e0ab49b2af77e7efbef087b665b2fe718e42b3aeb0d591d305149f7ae7f070b516f8d8c7e754189f3b1ec6f73f3d9cf3894cd1217327c9389d2b8b177
-
Filesize
1KB
MD58522f69f07eb5f86c93bc50d58a41aac
SHA1e537ea9a71d2885d4c751be5ccec9906b4cfd63c
SHA256ed675d70df365960ac4c940950b1971517856e04b2bba5a14eb49129ec718f92
SHA512cc93ad9d28607df6441c22d4f57c96c3e08c27fbb0b5ebd57900f279c6ccac3b31a98c82c529b50c54e869e2b1da727f6326f7fa0304a81a00c4e0c7e6ec8f28
-
Filesize
6KB
MD569837c4506993d70dd685a73384e6eb4
SHA147ffe03c1ada2d97707d0861e94ee7219cb88658
SHA256ac34da75afda3ac30cde4646b5d429a1a49440ff753331cb233502aaec1b7663
SHA512b72c9a931aa7d42d946ff3810d8ea47fe26549796176bcfe5864d9c39e635567a8aeb05d9b9a3662303b24c53a7be2537afec731e82c5d7e29e2d0565815c3a6
-
Filesize
6KB
MD51dde01431dda1f022c66ad627b4b9a0e
SHA1a978bc832de7688824d638b023bc8839fa35ae95
SHA2565a24f47be6c00d03e38a2e43cfd08f3a39bd2beeb559cd1cb1f0e539d364d259
SHA512b44a10169fc57f0faaed83c91de2c374f46846336a0fe20834a56969cbd8c628cd49e502831c68ff7a57a23fcb1d6149e36af84047d536aa8f6cf366a963bacc
-
Filesize
5KB
MD58be3efbd531c45de5a8a2e12e50ca46e
SHA1af8c2fd942a293d134948ea8d9fb2b576374db9b
SHA25633f6c695f78906b9e28da7bc892f8e9d4e7ba3fc411ac02b9d751a2da06fc768
SHA512b754299dbd0c007f172bec261190bc88904ca0eeb87a7e987135e6ac7030f30cbf8786b1a840538ca69038d7bd2031d4413d475eb7cc23c9f625a4a518103eb2
-
Filesize
128KB
MD527970bd5b762445ac6f2792639711c1e
SHA10f08f42cae735c2352e55c1f00b87fa23efd370d
SHA2563c1a6d1844ca31e8990d9fdd53199fae5372c312719e868115313a0910c204ee
SHA512ba008514385bd5c14ab39b4bb25e01460678d533e2dbc05075cd25030c7899d701e74f0d3818c62516d4d33b4e7114ce755ca419a9b59fb0920e8d95c9b200e0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd