Resubmissions
14-05-2024 01:41
240514-b4dp8seg23 114-05-2024 01:41
240514-b35gkaea8t 414-05-2024 01:40
240514-b3hb2aef42 1Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-05-2024 01:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://google.com
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
https://google.com
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
https://google.com
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
https://google.com
Resource
win11-20240426-en
General
-
Target
https://google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601302920410182" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4748 chrome.exe 4748 chrome.exe 1080 chrome.exe 1080 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe Token: SeShutdownPrivilege 4748 chrome.exe Token: SeCreatePagefilePrivilege 4748 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe 4748 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4748 wrote to memory of 4540 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 4540 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 3876 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 4128 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 4128 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe PID 4748 wrote to memory of 1892 4748 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe01eaab58,0x7ffe01eaab68,0x7ffe01eaab782⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:22⤵PID:3876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:82⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:82⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1848 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:12⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:12⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4228 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:12⤵PID:3564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4376 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:82⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3196 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:82⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1080
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD58153ece92397a5ffdcdddb3cbb1e4ef7
SHA1c68e008cceeca293e62dd1cc1cef65a0c0954176
SHA25638b6ffe83aa843286751d22ba757fefb3269cac07105afd18c2156b36c275536
SHA512f7a708871b2a4934bfeae5edadca44abd66d699c7450fcd9f54613a9a4991424ae4b49a458eb407992a55d1d76b4a9e726eecd4eeb4a33686a9806f6bd5d6545
-
Filesize
2KB
MD581dc45aebf9a50ea55f1c12ce36f158b
SHA1e99d07f97786a2a3eef19b9c1f3a07d89b63bf93
SHA256c40ab0a1d94c08c3c2262c12dff5b3298ab974d4441703c878931a88533dd06d
SHA512e9a5257a05d37f9f01eaed68b40dff148529dc59e2fc304e4e5b300211d4889342b4b0502699e4a0d788ccb4a451cf79c16dd8505cea122307efa89a80eaf5a4
-
Filesize
2KB
MD5b52a720f2175b8049a828d6acd0099de
SHA192fdc6477e791922f09c6922262f6b16d2caaaa1
SHA256c894c80e0a8597697e5879e72321ea14d63a14f2aa62b33ef91cda065689e791
SHA5123ebfdd9de18b1917707ecbe49d8d4b0814d81e0892cd0e62c626ab5eb038dd247da41324796f581651af608cc7fd926416389109824672c4317761c37536d157
-
Filesize
2KB
MD5fccbc827accc18dc99efc729945f8a98
SHA182592e4a2213c16c450b96b97729d71b852438e3
SHA25629e5fb200598c8c553b83a4f71425eeca12f086da8481a381cafcb0cf5bde906
SHA512eff5147db6bca298ae1bc511f1073edb36297725defaf91fca105275513c9989384798b43124277f7093899d21ff9e86b1c7e5c784d62cb3f3c27723f2fa3109
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD597a03fabde8b8bd83a35010341b5b2cb
SHA18c2ac2f29d28aa57f2f89ca099b5ab8ff685a14a
SHA256db058c9f5b0b236dd92face7390c90309f89f33a80bed94070a024fdf379ecc2
SHA5121c7f23f0b1858c1750597d54634fde93d14a2023bcc34b6974de8f1e3d6f64e639617c2af7b6603e2c58a68a8e61a8ea5635a28c8cbcaad31f42ede3d1ed7ece
-
Filesize
7KB
MD5aa8d26c49452f3f5603c370c99aea600
SHA17ad4a7a6a47ca2f53b39443340adb2219df938e2
SHA256631391953ae23848a116bc09c7eb7986e542e737b18b18905efdc207c015783a
SHA5120f6a9330e4ce35bf9286b463993f991b781888ffdc703647d20f769179de7ca7a6cfc1818f12d6aacdaf2e0ff9e365cdb3bd13fb0f90e79bc2521e293eaa0a49
-
Filesize
256KB
MD53061d914d42e3cc9f37712ec19cb1abf
SHA1f94ca22676b72d0dc6a8b74e8cc3520d4e117a8f
SHA2569882c6582ab787f4aee170b6a550a96284f4339ffcfb4f00c574745c57b8a7f0
SHA512c8353ee2348f0fe770d646ce0098ae486cc24b270a30c0166b2176ec8bad291bed38bcfef5ea7368d28637b8e021bd0d77a498e692fc43d357d73e17fd8b84b3
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e