Analysis
-
max time kernel
133s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 17:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://LINKPROTECT.CUDASVC.COM/URL?A=HTTP%3A%2F%2FWWW.CAFERIO.COM%2FCATERING&C=E
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://LINKPROTECT.CUDASVC.COM/URL?A=HTTP%3A%2F%2FWWW.CAFERIO.COM%2FCATERING&C=E
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601804913147390" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2188 chrome.exe 2188 chrome.exe 4344 chrome.exe 4344 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2188 chrome.exe 2188 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe Token: SeShutdownPrivilege 2188 chrome.exe Token: SeCreatePagefilePrivilege 2188 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe 2188 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 4328 2188 chrome.exe 83 PID 2188 wrote to memory of 4328 2188 chrome.exe 83 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 4616 2188 chrome.exe 84 PID 2188 wrote to memory of 1164 2188 chrome.exe 85 PID 2188 wrote to memory of 1164 2188 chrome.exe 85 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86 PID 2188 wrote to memory of 4896 2188 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://LINKPROTECT.CUDASVC.COM/URL?A=HTTP%3A%2F%2FWWW.CAFERIO.COM%2FCATERING&C=E1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fad2ab58,0x7ff9fad2ab68,0x7ff9fad2ab782⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1936,i,8111868538247277958,4316837829306429953,131072 /prefetch:22⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1936,i,8111868538247277958,4316837829306429953,131072 /prefetch:82⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2268 --field-trial-handle=1936,i,8111868538247277958,4316837829306429953,131072 /prefetch:82⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1936,i,8111868538247277958,4316837829306429953,131072 /prefetch:12⤵PID:2804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1936,i,8111868538247277958,4316837829306429953,131072 /prefetch:12⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4252 --field-trial-handle=1936,i,8111868538247277958,4316837829306429953,131072 /prefetch:82⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1936,i,8111868538247277958,4316837829306429953,131072 /prefetch:82⤵PID:3976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1044 --field-trial-handle=1936,i,8111868538247277958,4316837829306429953,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4344
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD536f2845b048541c19449cc32bbd372d4
SHA14564331c849a797473308cad08cbe464686770d7
SHA25662fccabc2660278b1557614cd43d418afca2f526fee0f593216e52c1061ae4e6
SHA5123c2fc5ad30f5c3a861164f00ddd6a20a1f7ae2ca3f295308bf3f09b3dc8ab3448556d29469559a181ff8b2a9e86ce5ff44df7ad2c954a97881ab7073b54a7dab
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
521B
MD5bd0cb009356d3ef42b725441c0db17fa
SHA101d37c63ab73ff16b4cef6d19ff09918ca005f2d
SHA256a0e84ba6468c173efdd5c4d027f4c8d4c2aa91d7290bada27e02cd513e48d95e
SHA5122b979e4181829598e44487fd62580e2d26d1d2f76e4a1036ae483885f49a480f8904a661af40e95a27e1b6292c01ea3a91a5a60e0ffd5ac7b9c3124e52d18788
-
Filesize
7KB
MD542186f0270ccd7eab001d4e76846cbbd
SHA1d812486bca8bbc1de39ef04e5f1d773202a4c786
SHA256fd0b09ca8603a3cad4f923d29748c88940eade44c8d9916a92b6f5853eebe944
SHA512727f62f0ce38877ff51cb136be9b4fa073dba97f56acbb3ca61b9d3d20f86e1d7aadeef92318a326e3f534cce69716368d10215ff1063645e1d0d441e99651b3
-
Filesize
130KB
MD59746770b1fc5a50ffdffd590a2ea4073
SHA13b2d3e56de0981d476a0d3e587e707167168162b
SHA256f1c3fb538b699a9ef2d985e96247b2a48146a0acf50a3079f80ac9c660a74b95
SHA5129b92c79f24d98270a9ac69e7ca029c608f9413fdcd2d5454f9aaf36cfb7d87da7d88acf46dc86342242ea179c510737eb4e2b3fb3efb13b94fd3de774d0a575e