Analysis
-
max time kernel
1800s -
max time network
1685s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 11:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://nzp.gay
Resource
win10v2004-20240508-en
General
-
Target
http://nzp.gay
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601603662058279" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 3904 chrome.exe 3904 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 448 chrome.exe 448 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 448 wrote to memory of 5112 448 chrome.exe 80 PID 448 wrote to memory of 5112 448 chrome.exe 80 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 2648 448 chrome.exe 81 PID 448 wrote to memory of 4656 448 chrome.exe 82 PID 448 wrote to memory of 4656 448 chrome.exe 82 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83 PID 448 wrote to memory of 1248 448 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://nzp.gay1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0a6ab58,0x7ff8c0a6ab68,0x7ff8c0a6ab782⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:22⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:82⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2292 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:82⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:12⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2852 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:12⤵PID:720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:82⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:82⤵PID:512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4632 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:82⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4364 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:82⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:82⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:82⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 --field-trial-handle=1992,i,10111719171075353677,5264729133048206988,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3904
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2064
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b0 0x5081⤵PID:1720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD5cfaefe293c60b1308426faebb2404964
SHA1f7122b60deadbb22af4e16d138172aafd8211988
SHA25674c471b705375c57cff86b82bad0b7e2c1076e63bf18df649139acc60f278272
SHA5124aa3355391a40629c42f7b7610deed1eda3bad7e68bc95919bb7a8ca95064effbe007ec03cec87e768596013629ccd16e78f5776c5f9b1093560b7dcd163227c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Filesize96B
MD5b5ebfb15d5ad687042cdc715b095d614
SHA129213cce3c2a20fe976498ba316e40d13e9d15cf
SHA2563d9181c0d769ab816f9a758ef8676ec8a864d9a1bb695a612c02d5a56f16f9d4
SHA512d9e0ead8649383a9eaaa3db44ac4ae76287bfa598782eb87d4f50cb6e7ff516aa2116067191c224e9c95f8d1ffd7bc5854ff7a269f735ff87dfc77ee9026875f
-
Filesize
1KB
MD52916165166e6ebba2f7e8224314f2e94
SHA1b828e8c1abd2be9e69b1c8f2248f2fdf514a65b9
SHA256d3fa9fc1afa6e60eb1b7f703b5cbd4f0aa744d380b927bee1a321ef66958becb
SHA512f595eb02cbffc99503bd30f8c21d0f489b5213dd4a097437b862bf16ccd96d3ed875176b16f015f0d62937cb9706033c475510b2bcf9704b68bd62af52f8e806
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD55d2b2b545881df1a763716141460f802
SHA1097fe6179971ded0f7d1ab331d98b6efb25e3798
SHA256dc2ac6a2bf0cb1d2a67593076fb35061cdf60be241768f28780b855daf438454
SHA51242ac0269fa0ea053b25e48925b218aac01001b35bad78e4bab087b05d2709b0b66e9d838a44575460684326cb2c30cf8e90bba2bce3ee9d954023785af0fabec
-
Filesize
257KB
MD574feea35c8b725f88f510da4fc755019
SHA14ef45c091564112f7be3b733c050f2db4eac8b75
SHA256056cfd34313ace9cb1da5327129a1d0df917cfe6f1fd9aad43028ecfa44c969d
SHA512427b62163a9d3a5bdbddbc3513047fe7953c6e4307e4a20274a7c71e9398a77b9893a1f5932b2ff57f967adcab197b0c4e500d614c61a189814b4f5493452e35
-
Filesize
257KB
MD589a814c6c180b35867f704d5d8d9b20d
SHA1de10f56912b697547114a69ce5733cedb4041aa2
SHA2564e1969ab52d3e99fe3919b787c19e3f74c9ca74dcf995aa62c84f1cd8bfefe94
SHA512f8ef20bf0272b642d7787c09ca9a228cf71c558a20b7f67ba2760d2e195b2a680a9a105ae94048ddb13319d3159d0d6ad224fdf85d813c2fdf252d6dfc09399a
-
Filesize
257KB
MD522867abbe5d8b79d93a5592f372a7a3a
SHA15b311045080c203477fafb6425eac8391d28579c
SHA256cf1fb213d01b13ed9c193c5bd0f78898c13ff2e4a58fab7ece1b04408ccd65a4
SHA5129942697f201af841a2f34a36b8a813488b11ba600299972fd9e9fb94841f674cd8c561e24601b4f8d070067ac04804e24f9b4860d9dbc9675b03170f7fd1b6c4
-
Filesize
92KB
MD51c6cd80a9b817d14a626eac04e38d44f
SHA187d965c515b4f713a62063a2ccda0525b1339612
SHA256fd4a9a9b720b8b39cf2a626df33923bf3a562eb8e48ff27672af15218754df92
SHA51222e7bbf172446e11e153aa0bb2b7a34657d4ad0cf140134c38ec1a03e2c4a8d59fab49d37dfe3ea531dd1ed9ad2332bc6851f4a9c0ed84a328509f781e5b05a8
-
Filesize
89KB
MD522b1df32f3374469f67b1b2c2e74b244
SHA110f996027d2467054950c332c856847b72672ce5
SHA256792be0a36ae4a3271c7817d135927385b0b0216232a80cfffa349db35625791c
SHA5121e1a436581634099822c7959c77d6ce142a6a8ee15fe4c3b993c9092292c3624abe4396561c38749e17b54afa5c0255283c6fc17b88af6df3476da3b119b9485