Analysis
-
max time kernel
1799s -
max time network
1687s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
10-05-2024 15:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Google.com
Resource
win10-20240404-en
General
-
Target
http://Google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133598469476660252" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4412 chrome.exe 4412 chrome.exe 4936 chrome.exe 4936 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe Token: SeShutdownPrivilege 4412 chrome.exe Token: SeCreatePagefilePrivilege 4412 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe 4412 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 1212 4412 chrome.exe 73 PID 4412 wrote to memory of 1212 4412 chrome.exe 73 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 3508 4412 chrome.exe 75 PID 4412 wrote to memory of 2388 4412 chrome.exe 76 PID 4412 wrote to memory of 2388 4412 chrome.exe 76 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77 PID 4412 wrote to memory of 2804 4412 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Google.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffab0239758,0x7ffab0239768,0x7ffab02397782⤵PID:1212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1840,i,10275693318215408139,13270078472816628972,131072 /prefetch:22⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1840,i,10275693318215408139,13270078472816628972,131072 /prefetch:82⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2044 --field-trial-handle=1840,i,10275693318215408139,13270078472816628972,131072 /prefetch:82⤵PID:2804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2564 --field-trial-handle=1840,i,10275693318215408139,13270078472816628972,131072 /prefetch:12⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2572 --field-trial-handle=1840,i,10275693318215408139,13270078472816628972,131072 /prefetch:12⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4356 --field-trial-handle=1840,i,10275693318215408139,13270078472816628972,131072 /prefetch:12⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=1840,i,10275693318215408139,13270078472816628972,131072 /prefetch:82⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 --field-trial-handle=1840,i,10275693318215408139,13270078472816628972,131072 /prefetch:82⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1504 --field-trial-handle=1840,i,10275693318215408139,13270078472816628972,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4936
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD593a8f857ce1f3109c35b5386b0a2a82c
SHA193b329970a22603d3e07af68d41fdb0989acb688
SHA256e8b8480bddaae0a413149dfbdddbb2676781328ec35d4b77e06c7b89cd4039a7
SHA5122121d19314adce226faeec777ddb12b8e58d37288ec50af5072e6e9f0218bb8ccb3f1502466f3414c2198dcbece9a448b89e7379460a84271d21e15d4c722bab
-
Filesize
2KB
MD548bd4aa8e3613184da0eff91c360a0d6
SHA128ede5ad25307ad7cfe3c31630d47356c8014df9
SHA256415156fba7f94a658d751c1528f9ea783a352e04bbae0a52ccbdacd5dc03ca3c
SHA512833aaa62b7cc820f1f9f9b7349128afb5828ffea6be987fd0e14c304a2e1ca033fbc38742d5c069626054f5b9fe9e462d79eb703e9c1f5cb3c5ff28de283baab
-
Filesize
1KB
MD5ee536a335959627f6804bf61620d17d2
SHA15c0871865d48bfe1c04ec5c02d544546ba58b13b
SHA256a258ba9cb49aa273ae148898ba059d1ace6d17aa7eaf5f0e731b4c2f7c243275
SHA512e7ae31489f0c86ec0dfdf32462bf527529dc469f68065a966ceac596aeca6c9c94d4b22ac0bf94cde6af5ba55283cbe030c412ef09d8de52a38d81c4d2e9bc3a
-
Filesize
1KB
MD5bdbfa402c9aa518aa1feac53da43cc5d
SHA1d1257dcef27b222dd8620250cd68c0185d2e14f2
SHA2560422564516e5ab21f48a9d323fa464f080f35ce71b09e6603abe4cbe1688f467
SHA51248488a0016471de360fa6b4cfe4d085ca41e041e9e5f650f063f0ffdfc138231f5c4c8cf75f56c535e6b261657b285bfe441f8c4eb32616b387d5a391f98295e
-
Filesize
2KB
MD57be3acc7134f6d86e34538b78008f156
SHA1ca410bbe44eeac116fc138d855b8c930dd40d4ec
SHA25650e69d387db2ec825607c4892aba3823d35091e053459721f782e640fb50a310
SHA512f8df0887bbdc93c44d0971ce3bfa4c0617426f58e0137737facbfe920245dbe75efcdf2d0e054272f43c901548202bf7d9fd4829074f0d43a635259dafe3f819
-
Filesize
371B
MD5d7030bf9e703fdfae0baee6886bae47d
SHA163bdb6e5297f6f2f19592be11dc3e78fe8958109
SHA2563a0dd04b2916254b613d7fd29507e312bb3890331074fbb0744d7a2df69a8701
SHA5122b883219f7fc9993964e559222b65511a12635de322628a066a60ed101085073329aa2641b51c4ef33f689a2218534eea932b9b7b7e5390dc4de410d9e076935
-
Filesize
6KB
MD5bdeefe23adbbce3721af39b6b9b56c8c
SHA1f61514198dd79e423e1385807bcd8171476e2a6a
SHA256af1bd8da7e2d6364a853d3412a33a5d2662ca1fe0b7376b4f22c17090fdd2b4d
SHA512813f892e09d14d184d5b206d643250adaa5db25469d33435859b9a57c8ded7956fd8b33eb7b73a57aaf27773d3be0e708f4968cb410f6a4e2dbd22e6990d0a83
-
Filesize
6KB
MD514bafa8369a9c389a671bad44deacc00
SHA18eac99e974d8efc3bdb4fea9b01e91a9025171a4
SHA256530216ebc046b9c846244fad2f82c92119363e8f8f372e0a828e61175d8cfa53
SHA512ab89de52e621ebb005f6e52b6b88956abc5c9107f99b7b4377a8d5f16beea1c9469d9a5316a74affd2db88f3bcc7ac9a7afe5a9e5bbf9e5dd6bc705d2b0433d6
-
Filesize
6KB
MD5c18907b891940d84ba4786ad9100213a
SHA106ccd2becea3d5f78739c2f2386b7ccf0af2074d
SHA256c2a7d658c76ce9dfa14ab40beb0ad02a9238c2ca19ed5e445c5d6f6973313456
SHA5122cc0b4c75b41195995ab66cf533bd9504be0361b6e941109810b47a876655e68415abd63f69892a57205dab898d677342749f69c6a591c487b1a5c0e242b7032
-
Filesize
136KB
MD546a33227d6c6e9bd7391b81c6d563d78
SHA1d4d370597d216b488111af0e626dbe6d155408ad
SHA2562f3d06b1461f1d14b35c76fcf3d2a2b29d4fd3c5c420ba383e4d5dd5eef3fb62
SHA5128bc4bda2135c883da96642a635105c1cba750cc88d02c7228863741a258a3f89ce69e06b10b8e066fa715f9a3b87538f81ec7a104401443260325a02940ff615
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd