Analysis
-
max time kernel
299s -
max time network
245s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 20:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://onlinehr.net/t/8961/28636/member/Images/email/accountPassword-white.png
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
https://onlinehr.net/t/8961/28636/member/Images/email/accountPassword-white.png
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133597586189903769" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3104 chrome.exe 3104 chrome.exe 4996 chrome.exe 4996 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3104 chrome.exe 3104 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3104 wrote to memory of 4400 3104 chrome.exe 82 PID 3104 wrote to memory of 4400 3104 chrome.exe 82 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 1816 3104 chrome.exe 85 PID 3104 wrote to memory of 2396 3104 chrome.exe 86 PID 3104 wrote to memory of 2396 3104 chrome.exe 86 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87 PID 3104 wrote to memory of 3616 3104 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://onlinehr.net/t/8961/28636/member/Images/email/accountPassword-white.png1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff824c3ab58,0x7ff824c3ab68,0x7ff824c3ab782⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1896,i,6087357597472883161,12139958780521094088,131072 /prefetch:22⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1896,i,6087357597472883161,12139958780521094088,131072 /prefetch:82⤵PID:2396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1896,i,6087357597472883161,12139958780521094088,131072 /prefetch:82⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1896,i,6087357597472883161,12139958780521094088,131072 /prefetch:12⤵PID:540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1896,i,6087357597472883161,12139958780521094088,131072 /prefetch:12⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4288 --field-trial-handle=1896,i,6087357597472883161,12139958780521094088,131072 /prefetch:82⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=1896,i,6087357597472883161,12139958780521094088,131072 /prefetch:82⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=988 --field-trial-handle=1896,i,6087357597472883161,12139958780521094088,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4996
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD5908c04faea41fcb34fc459e1f6b1675d
SHA19e7ed4a79f4be0a9d4e0ae676099d82a17398710
SHA2563f8ad6f12f3aca502bf561d1f2c917ecc725d34398f5c5630bd2ca3a68fb157a
SHA512e1f95937766f45faaa954599fcd25b427ae83253357bdb8c102ec55455e50773b63b5a707a21d6ff874caaa838f4e255377a258f048993a75bd3916a8725e04d
-
Filesize
7KB
MD50952ec3c81f7371e0227faebcfc55dd1
SHA149e66df0180ac84af68f0b1b2ce5f4a9c70ea9ba
SHA256ecb020ec220a31387281c5b7e269c73ab7ce791e30f7bd88781bbe0b66afa491
SHA512a09f01d511b52a79c4bac2e872e83cc680e7a2fba909f9afe2d87a2b66845e51d425764e695199d1a41264f712e0299179f7853e49e62e300af9b2a00aa84ece
-
Filesize
129KB
MD5079ab4c5c799fd31ee68649cf81098d2
SHA18904943a405ef28a6c45a5ecef8375d8fff8cba3
SHA25625806e4134492db193a17dfa67221ce3e356c3d923daec4f7e67be0e8ead81aa
SHA51232f51949bdcf4b2f762d8b10ce8c3f8d99a4f9746b3ab9c958c17d733b7caf4ffca686be70fd671c63eca810ea80ba098ba36d9629b37fe429963b59705ab2ef