Analysis
-
max time kernel
300s -
max time network
245s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
12-05-2024 08:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://u.to/3e_pIA
Resource
win11-20240426-en
General
-
Target
https://u.to/3e_pIA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133599759560798107" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3876 chrome.exe 3876 chrome.exe 4892 chrome.exe 4892 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe Token: SeShutdownPrivilege 3876 chrome.exe Token: SeCreatePagefilePrivilege 3876 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe 3876 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3876 wrote to memory of 4416 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 4416 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 3176 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 568 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 568 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe PID 3876 wrote to memory of 1620 3876 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u.to/3e_pIA1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdd90fab58,0x7ffdd90fab68,0x7ffdd90fab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1504 --field-trial-handle=1800,i,7839995076884267706,8221003283190408481,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1800,i,7839995076884267706,8221003283190408481,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2160 --field-trial-handle=1800,i,7839995076884267706,8221003283190408481,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1800,i,7839995076884267706,8221003283190408481,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1800,i,7839995076884267706,8221003283190408481,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4280 --field-trial-handle=1800,i,7839995076884267706,8221003283190408481,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1800,i,7839995076884267706,8221003283190408481,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1800,i,7839995076884267706,8221003283190408481,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1800,i,7839995076884267706,8221003283190408481,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD57365dfb991af23706d480ed2ece2fdc2
SHA1b1d9c37b368928665ac38ed04388501269cc75d0
SHA256bd9841ca076a8fbedd4898ced864262f266b2de9cb54022cca91bfb6fa11b930
SHA51226bf093bc969a76ccd693acc7dcc3919de37fa9134deaca4ab1c2c2f4283f7bb9961e068e3d15fd8de72725c77ca5fdfe15cacbcac842c76fe13af8fdd00dd34
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5fdcc273c5eeda5a83f617e42e6903ef7
SHA17ec3d2ba39188da6bdf84841c6321c0c981ed16b
SHA256433e52993c2d2566c2183c9ca5fe7eba78c9555af19f8d0ba07043b3c27e7509
SHA51268783a6839f2e02030e706f1a1a665893d9bf2c2d46dfbba7d9109b2a55776952eb2de589558336f08ed1e79989d82d9a4d22db9c1941d98a4064ad86a63c3dd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
689B
MD51d347c14ab65a967df725df4af63411f
SHA1e5bbdfe8260467a7714e72211ab31a8857fe796c
SHA25614aa5d57bed4fd486e2b057da2c0f95417a21f37178bff8b84a347ab0372e7c8
SHA5128d7a08f5a8ee59b009e5d6fcde319920afc7abcb5ec47620f766adcdf8260ef571c39c45fa5107b7e33079fb6a7c2ed555c2943796f795872e08ac7184551139
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD592c9c9beef0508f4e497a7c00257dc1c
SHA183bb2bb98c5c5a47ca035da26530fe4932a3591a
SHA256404d71f03a96c7ce7e85daf99eed2369f9a88f898ca0bddc0254b70fc18cbdc8
SHA51256b7b3d55943fed9180347b11665c4f5663f5f4ec8d1d36e110a5e157fa4dac69b942aadc7e2c135f11700ec8adb8c5639b59afffdaddfbf36cec34a51eb01ca
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD5f090cee1f1d11937822a3404ca995eab
SHA147ef6a1fc919d7e9c10e7d8aba729e09201665e8
SHA25666709a6695ca002fbb0a9aaf45f2d143225f2b7c6615a9623bc413965b37df01
SHA512b5cc7749be036dd81cc43334c58cddc8dfb7a4e3f95523e8693ff9a9483a99aba037555053de754f36d2065e3c1c1ed105b917e25012611f3185769c9d3c243e
-
\??\pipe\crashpad_3876_XUHJXPAAGGMTZRUIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e