Overview
overview
7Static
static
1URLScan
urlscan
https://hallenge51.c...
windows7-x64
1https://hallenge51.c...
windows10-1703-x64
1https://hallenge51.c...
windows10-2004-x64
1https://hallenge51.c...
windows11-21h2-x64
4https://hallenge51.c...
android-10-x64
7https://hallenge51.c...
android-11-x64
7https://hallenge51.c...
android-9-x86
7https://hallenge51.c...
macos-10.15-amd64
4https://hallenge51.c...
ubuntu-20.04-amd64
4Analysis
- max time kernel
59s - max time network
65s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
10/05/2024, 10:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://hallenge51.cc/invite/i=63719
Resource
win7-20240508-en
windows7-x64
6 signatures
60 seconds
Behavioral task
behavioral2
Sample
https://hallenge51.cc/invite/i=63719
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
60 seconds
Behavioral task
behavioral3
Sample
https://hallenge51.cc/invite/i=63719
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
60 seconds
Behavioral task
behavioral4
Sample
https://hallenge51.cc/invite/i=63719
Resource
win11-20240419-en
windows11-21h2-x64
9 signatures
60 seconds
Behavioral task
behavioral5
Sample
https://hallenge51.cc/invite/i=63719
Resource
android-x64-20240506-en
android-10-x64
3 signatures
60 seconds
Behavioral task
behavioral6
Sample
https://hallenge51.cc/invite/i=63719
Resource
android-x64-arm64-20240506-en
android-11-x64
2 signatures
60 seconds
Behavioral task
behavioral7
Sample
https://hallenge51.cc/invite/i=63719
Resource
android-x86-arm-20240506-en
android-9-x86
2 signatures
60 seconds
Behavioral task
behavioral8
Sample
https://hallenge51.cc/invite/i=63719
Resource
macos-20240410-en
macos-10.15-amd64
1 signatures
60 seconds
Behavioral task
behavioral9
Sample
https://hallenge51.cc/invite/i=63719
Resource
ubuntu2004-amd64-20240508-en
ubuntu-20.04-amd64
6 signatures
60 seconds
General
- Target https://hallenge51.cc/invite/i=63719
- Sample240510-mp7wbadb56
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133598111956079354" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 660 chrome.exe 660 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 660 chrome.exe 660 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe Token: SeShutdownPrivilege 660 chrome.exe Token: SeCreatePagefilePrivilege 660 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 660 wrote to memory of 2096 660 chrome.exe 71 PID 660 wrote to memory of 2096 660 chrome.exe 71 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4516 660 chrome.exe 73 PID 660 wrote to memory of 4268 660 chrome.exe 74 PID 660 wrote to memory of 4268 660 chrome.exe 74 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75 PID 660 wrote to memory of 4708 660 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hallenge51.cc/invite/i=637191⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8ace9758,0x7ffe8ace9768,0x7ffe8ace97782⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1844,i,6532604347039732378,13984917122873198045,131072 /prefetch:22⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1844,i,6532604347039732378,13984917122873198045,131072 /prefetch:82⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1844,i,6532604347039732378,13984917122873198045,131072 /prefetch:82⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1844,i,6532604347039732378,13984917122873198045,131072 /prefetch:12⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1844,i,6532604347039732378,13984917122873198045,131072 /prefetch:12⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 --field-trial-handle=1844,i,6532604347039732378,13984917122873198045,131072 /prefetch:82⤵PID:528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1844,i,6532604347039732378,13984917122873198045,131072 /prefetch:82⤵PID:1572
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 42a5b9b34fff1cab8f91410b6a54b0ee0aadf2c2bedc17a92ff74761801a4c95
- MD5 dbf298c18a0e67637d81c3a4e2c05ff5
- SHA1 d0e3751cb50d7e6c97bc74c2cbf7f699ec80917b
- SHA512 e327d0800c8c49bdff563a8f4abf23a592172e0fb72fea5746f9654a9c8f200df5d185ba454a044d4e352559209de6c8b5e2d726016f4c08df0b1a60f9cc9162
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 e7740bfe470ad76d382f82498e59939dcfa9e2d8e09c46659901fbab47fd4b61
- MD5 00cb4771e9a3cdf8245d395051fe3735
- SHA1 d7b184cbfa2fa3efc425065067807bad3859096d
- SHA512 be2466098a02b652e96f9e40d1e7a66ec7655c75b45d71e3296ef7463db10a09d13911e32c7382da7b68984f043813e534f8dba505f03ff31cdd4cc42d6b3549
- SSDEEP 96:n9R6ADKIXqCE8iZRy7Di+6Msmdefk+1u+OsxiAVjVhYtjEsXt0/cg2Vup:n9jDc8syy+Fmk+TFotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 74d139ccf18a0d7821ef662541eaed2bbb27f82a03fee22a3f96b307d128cc6b
- MD5 c481efd51b10316015f535ac35998673
- SHA1 cf02753b62ebb13411d52cbcb13e4eed9d61b766
- SHA512 d0db1bc93018cbebb353076c95b024837e9cc2c59c917139f639f496af08360ba073b06f621408211c29262e92d85178817ea504c884962b4c844e2167c0eb61
- SSDEEP 96:n9R6ADKIXqCE8iZRy7Di+6Msmdefk+1uYOsxiAVjVhYtjEsXt0/cg2Vup:n9jDc8syy+Fmk+tFotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 136KB
- SHA256 df3698e1b3beb19c70514f9377e17a012e37897409c33e6cdd1bb063b512de94
- MD5 ca32c24b0ff3504fea9028057acdb259
- SHA1 052345b60bc2151dc1cb985c20f963c0c68957ce
- SHA512 5af11c3cbea4bb0322cff99313a2130c22cc1c8581ec5170a330f2975b02c5a96dc64a34f1a6e4b7bad5f5f6f14498c90e1a216478bf8e0dedfe878482d2309f
- SSDEEP 3072:ie33uAy3vehSmpLKe2iO0i8IfZAanIC7RA0T9Q6L3tG:ie33uWhSmpGeLOpH576KQ6L9G
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512