Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 02:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://france-ae.com/wp-content/plugins/rencontre/inc/photo_import/dd.png
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://france-ae.com/wp-content/plugins/rencontre/inc/photo_import/dd.png
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133602131952045287" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2652 chrome.exe 2652 chrome.exe 3096 chrome.exe 3096 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2652 chrome.exe 2652 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe Token: SeShutdownPrivilege 2652 chrome.exe Token: SeCreatePagefilePrivilege 2652 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe 2652 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 1672 2652 chrome.exe 82 PID 2652 wrote to memory of 1672 2652 chrome.exe 82 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1964 2652 chrome.exe 84 PID 2652 wrote to memory of 1140 2652 chrome.exe 85 PID 2652 wrote to memory of 1140 2652 chrome.exe 85 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86 PID 2652 wrote to memory of 5004 2652 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://france-ae.com/wp-content/plugins/rencontre/inc/photo_import/dd.png1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a484ab58,0x7ff8a484ab68,0x7ff8a484ab782⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=2080,i,292227229483182821,16082261501718625779,131072 /prefetch:22⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=2080,i,292227229483182821,16082261501718625779,131072 /prefetch:82⤵PID:1140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=2080,i,292227229483182821,16082261501718625779,131072 /prefetch:82⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=2080,i,292227229483182821,16082261501718625779,131072 /prefetch:12⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=2080,i,292227229483182821,16082261501718625779,131072 /prefetch:12⤵PID:868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 --field-trial-handle=2080,i,292227229483182821,16082261501718625779,131072 /prefetch:82⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=2080,i,292227229483182821,16082261501718625779,131072 /prefetch:82⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=988 --field-trial-handle=2080,i,292227229483182821,16082261501718625779,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3096
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c3ff3f13d563f0d53fb02c2db7e71d89
SHA1eb5a4b92cba6b14bec825233ed8103b51aad9650
SHA2561b171835d9d8b85bc643be3220711eb212f6b70aeb5fc770e532d15a43ee47a2
SHA512f34e241c91dfb16d1882fc4a8568b28660266ccdda1370f9a5717e1c3a1633b462bb0712821a8b7051c8689b277bb0243622684990dc0c9d2b0fbc21d7797e08
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD50bfe2ce31504671fceb00e3b8b21fed0
SHA1c729bbaab588fb23e02cd19a6c24ec90260e6383
SHA2561961edb9e393b3889fb7e71bb3311f084ce0cea97872e8b6b5f1a2c9daef6d6b
SHA51232ce206494c0b3d8ed2c03a3f8ade1641667bffcc22de069c805539133b96580c643c340f36f6f319a02884d0c002a2a25a6c5016ebbd310640d3a0aed00700e
-
Filesize
255KB
MD50e84cb1554b3731486209b4e2d72a723
SHA1735db234cf89fc5b72e4b0b809b42329c6b8e2f1
SHA256f0a30ab1eac4eda6b91b14994c7f867309e47d672a2c199a68bb34476f184934
SHA51208bd6579c26c770f6d405fddb59ac821aee89c0c28f1aeffc04ae20649d8af4279cb50053643a0d692d9a7b0d138957e4d6c504a9e2397bb727c3aa81291e2d9