Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
09-05-2024 20:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dbsquaredlaw.top/fa9d0c5e174c1d461feb5d3d48c4fc8e663d330da2fadLOGfa9d0c5e174c1d461feb5d3d48c4fc8e663d330da2fae
Resource
win10-20240404-en
General
-
Target
https://dbsquaredlaw.top/fa9d0c5e174c1d461feb5d3d48c4fc8e663d330da2fadLOGfa9d0c5e174c1d461feb5d3d48c4fc8e663d330da2fae
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133597613880566620" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 2836 chrome.exe 2836 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4704 wrote to memory of 4568 4704 chrome.exe 72 PID 4704 wrote to memory of 4568 4704 chrome.exe 72 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 1836 4704 chrome.exe 74 PID 4704 wrote to memory of 5088 4704 chrome.exe 75 PID 4704 wrote to memory of 5088 4704 chrome.exe 75 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76 PID 4704 wrote to memory of 4004 4704 chrome.exe 76
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dbsquaredlaw.top/fa9d0c5e174c1d461feb5d3d48c4fc8e663d330da2fadLOGfa9d0c5e174c1d461feb5d3d48c4fc8e663d330da2fae1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb27329758,0x7ffb27329768,0x7ffb273297782⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:22⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:82⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:82⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:12⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:12⤵PID:96
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4352 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:12⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3140 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:12⤵PID:888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4548 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:12⤵PID:4300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:82⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:82⤵PID:2700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5152 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:82⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4828 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:12⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3672 --field-trial-handle=1796,i,3923240842642809334,654737828974088056,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2836
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3052
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3fc1⤵PID:2092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5be40253ff7a32ec547adcbcb7a81e75b
SHA148305ca1435b7c1fe758f3951def98834e865637
SHA2561f2f2ee3bd7b1d1bab75e089df5bd0a58b138d207b3bca4a94a2c8f5111c57c0
SHA51270931788b627c45719a635c604ae05433014e9eb0de91be9a1e27fa6031af1eadd5a9d03605aa65926a8493a3cb7e8c14b6cdbdbf022826e274f51ec39b598b3
-
Filesize
1KB
MD5ceceed67feebe01fe8461a91e9aac7ef
SHA11f8d8fa009ede6b6bc083a64c4c2555919eceaee
SHA25665571eed6727905bab989af14a139e4e8afce13f19429b62841d52a17b996091
SHA5124e2b25b7a0787f06b92f49d2464f9092c1cae25667eb79e8bc7b47c509b36a6e899d898074e56b7b36054071ab1089279b9ca5d04aed1c74cbe9824649e4b85a
-
Filesize
6KB
MD5dcf11a8c3d292dfd641b5a2a5a936627
SHA14b0b0944ba43fd08cd439bf92e217d5d123775c8
SHA25666f0165a079296145f813e5a807b7129c8a0168b20affd411a844821c8a15fa9
SHA5127ca390a69627240837eb92ab29df674bd857d6b9cd1e39933b1127925dbd0792e676bd02355dff7e664177c184be8296225b82e6a1249ac61046949774d08054
-
Filesize
6KB
MD5922000c1885062013a482004d18efe26
SHA1f5579262a2a13a4b8ccf65f2ea3062f1a1f6c216
SHA25639f4ef735e8c736913b50957b2c40bfea2d0355f154a274b4e1dace9ebc64b55
SHA512e135905173c1150bf924e64df907249ced1830eec8c3fff9f55c68e535d86912840764304b8a7c2c1951c403bcec1977957ee0b2f9082fdab9ac66663c2b110c
-
Filesize
6KB
MD54053ad62b4da92d563e2d9842d9d5d9b
SHA1511e1ee30bce565648b677503523e9f325792882
SHA25600075ae7dc5beed75d71711e4ad48d37d4450033adf16e157ee44cad1acab1b5
SHA512c93313ef39cdde315886dbc528f47d15750311aec9a62e1698c08757440719016e35c6b9d09a7d6c025dfe47c2bee9ac700b706b70b63c7438ec01e389f8d099
-
Filesize
136KB
MD5ccfb5062c47e754dbddffbecbae26538
SHA1d96bcccc7731cfe41b93673762d3f4a449a2d4fa
SHA25618b13d15a1da9d72cd2cf2505fcf90bd4d014f34caac7a87f5b2c29303a8d205
SHA5126b52b2ad9961fa9ad8d30b49750f2efd79281450f7abe581498af52f17e7f04124c911e6ef4abdaad92a74edb8179b1b60bac3ba443755123a6eef14b41d5164
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd