Analysis
-
max time kernel
74s -
max time network
74s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 16:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ten.com
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
http://ten.com
Resource
ubuntu2004-amd64-20240508-en
General
-
Target
http://ten.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133597471543222142" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3152 chrome.exe 3152 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 1200 3152 chrome.exe 82 PID 3152 wrote to memory of 1200 3152 chrome.exe 82 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4084 3152 chrome.exe 85 PID 3152 wrote to memory of 4428 3152 chrome.exe 86 PID 3152 wrote to memory of 4428 3152 chrome.exe 86 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87 PID 3152 wrote to memory of 4944 3152 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ten.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8591bab58,0x7ff8591bab68,0x7ff8591bab782⤵PID:1200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:22⤵PID:4084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:82⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:82⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:12⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:12⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4240 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:12⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2964 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:82⤵PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2960 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:82⤵PID:964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4760 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:12⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4920 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:12⤵PID:1856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4916 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:82⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3388 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:82⤵PID:816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5136 --field-trial-handle=1900,i,16084406428680895603,6069132416961433979,131072 /prefetch:12⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
696B
MD5bf74ae54c58640d930da2922813b80c6
SHA14ab26d80e137a0ecb856ea355434ef55f59581c6
SHA25638b8a1d43611d301750af211649a67e2173a9913975b3737dbd4a7cc3a8df4e3
SHA51202d72aa6b485fc811b6f628040d95378371aae36453b6f66a74463da6dbb7a2bf4ef9097d075801ed10b2af743d56b9db228c6b98b6cba268e0ac70c46510c4e
-
Filesize
3KB
MD5ac01e977295b66b5b8255886bdd26f21
SHA1312d2505586c923df859550ad74d7380bc375cce
SHA256b84c87a1726b67fef8e52119bbc9f468f7b34e41369b58d1f422cb327548c886
SHA512655a76ff4c9a5986de085c56f3185414dbefea031c9126cefea1e390a294262efe4e460551c569ae76dd13b59a0ac9efad05977614e8af6e3b83adbbd4ec2ae5
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD56626fa37d066837ff0fd34b147e3e2f3
SHA10d8c98bef608224e4da53ecc293fc6635df6b96b
SHA256258bd37faebdaf283f81de79cc2eb3ea0e308b11b19875ac97bbaae37f74a561
SHA512fa14ed7c2e83ecf9b5e5fcc6dd6c65c3d31460be14ebf882cc99794f442fb9e85d3d6583d1ca6abef9c306e80589b0d67277be5ba5ef92b9ebb334e253030fc2
-
Filesize
1KB
MD52350a1b1ec344b1ab68083e5e167413e
SHA1f6f7d08f377946c6e3961149e1f5e11febd853f2
SHA2562fec9fa10c0be6839fec9985ccf5fff8e16925e3a707266ae33bff2686434a81
SHA512eacbde61ca2e058df0c30c9594bd92d23d69613e0834167e7e00c17fe3549b915f5643c09acf0a4c795542ad2456b427b9dfd82bd87d32221678720cd9e62ad6
-
Filesize
7KB
MD5ba50984aedd9d5456bb1965184fba6a8
SHA1adff4f01ff14d18f86e366b4a875d2d1219116a8
SHA25612e9145798f0d111590dd02b847414f61d0480fb13586c962425ce1e8446b2cf
SHA512738cf0041f7c93f810479396ff7464e33ee41cbc799e8191afedec4caa4c8719d06a228051f5fadedeb2689578f4f11647cd70bc5468810fdf01212080327684
-
Filesize
7KB
MD5bf498839ac20d62dc29b8b0268604fe7
SHA1a0281d4be4c9d8324586c3606b13102d3b270a2f
SHA2565ef37b9e396186d093377a35ed4774be3459ac3d7c6d7e44250795bdd1e23547
SHA512c8c923a3ebf91f621e5560ee8b91334475d0f201fd30342e3601fb42db962a4e6fc5ae13d80a0183e1cda90307d52012ac8f37cc7ce8d3f7acde478f0b215496
-
Filesize
255KB
MD5c69d62d24d2e5ec71bb4428e03436c5a
SHA18ef949117519196aeb95bf7292525471b6674f88
SHA256ad5ccdca1f09c4bf84cc7c71cf206f34fcdaeae7ef168aa1f9c424677f909e67
SHA512d79f9a1ccf4c7aa24be3b1f920b208ded16b4bfc6d7ce233565143fcf10e64b2dff53645a01a0997ab72e0e648c8c089c6455a16e2dd791750522ae1cd0915c3
-
Filesize
255KB
MD58dd50b0e79b448c7367c6fa591a3328c
SHA12b1fb0ca1365d2823e692012d78e8ead533d412b
SHA256d894ea0969a3c7d32c3f330e12739a53514b83230ca19987ef96af34d77412db
SHA5124c2fb1eef1a662931f9ac2c39b0bcb777cde4cc13ca881909145a14a453f532f0779c9481b722d47f0d0228f31bb5b3c9c6530c8c4b9a7542f626dbf5d68df40