Resubmissions
22-05-2024 04:29
240522-e39m3aca78 1011-05-2024 11:09
240511-m9hrxsge69 1011-05-2024 10:59
240511-m3ndtsdd2y 109-05-2024 13:02
240509-p91nvaag8v 1004-05-2024 06:42
240504-hgj23ahe67 102-05-2024 14:21
240502-rpcsdscg77 10Analysis
-
max time kernel
222s -
max time network
214s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-05-2024 10:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://download.tt2dd.com/
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
https://download.tt2dd.com/
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
https://download.tt2dd.com/
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
https://download.tt2dd.com/
Resource
win11-20240508-en
General
-
Target
https://download.tt2dd.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133598990031064236" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1912 chrome.exe 1912 chrome.exe 3600 chrome.exe 3600 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 1912 chrome.exe 1912 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1912 wrote to memory of 1340 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 1340 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3144 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3580 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3580 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 2896 1912 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download.tt2dd.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaf6bbab58,0x7ffaf6bbab68,0x7ffaf6bbab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1800,i,575479221801509109,13409107658844644862,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1800,i,575479221801509109,13409107658844644862,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2120 --field-trial-handle=1800,i,575479221801509109,13409107658844644862,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1800,i,575479221801509109,13409107658844644862,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1800,i,575479221801509109,13409107658844644862,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3756 --field-trial-handle=1800,i,575479221801509109,13409107658844644862,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4204 --field-trial-handle=1800,i,575479221801509109,13409107658844644862,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 --field-trial-handle=1800,i,575479221801509109,13409107658844644862,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD53829daa5dcdc18c7b98a69d2194ae15a
SHA130b83a1705d1f7544bf9994276adc06ebae15c6d
SHA2562fd2c0feeccc465654f0cc3b6f32c2fa77537a11bf65f8e97b9efbf9ec49185c
SHA51248077b0feabab0bf9f3737da0b54e4c64580d4fdfff51135c8408ae2686274c48fc9d11734fd0fd76399a9d509c0151ad437c8589b8dd276808c6a40f0337fc3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
523B
MD50768562facc4caca018cd6aedc7d52dc
SHA1826f81768ebad842cda004d920e30945fe053da8
SHA25603a646a45dd3a0f2fa14a2766cf9ab0697127c7fcb28dbc355d197a29f588df0
SHA512967492bb62450327830baf7f4e5296eb908f6f243f1fc36d9d72bd6b78aa4ba9af7eeb3090524bc4dfa5cb99c1c3652efbc37bbde5a748524aa62beacfdbb09f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD52f8c0c9fcb61db95edfe767f65b93574
SHA16d61b69852a930fc5b4d00a51f56f7137f299246
SHA25641788a5c3a85fa833b258dab915a2b50d056eb2ef486e98714c30ee015fdf628
SHA512e612778d7f9b0adce65816195a8dae33581fddd327601eafea54ab9450f9a03fa5edd79cf6f478720bac1701c5a21a327e707550d86e4be375a94846ff1fd8c2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD56654c458a1015cbacdfdc539f169c04a
SHA18e6877458dc2a69ff9ccdf744d335259ddc0e7f2
SHA256abe58600dda484c337419b0a58b59da1a4e26210f7caa9e79f7c02f2dfcf1459
SHA5122ccf9a6f398e12e72dbf5976a5e4ccee2ac3a64d9bef2d9a417ba1e4f6480afc60b03e726f7e3cf0d840a19488c6ed59b34f6c521c0e852cf780381c52bf0700
-
\??\pipe\crashpad_1912_SGIJITBZDSVIZIBRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e