Analysis
-
max time kernel
90s -
max time network
90s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 04:24
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs
Processes:
flow ioc 72 https://login.bitvavo.com/u/login?state=hKFo2SBJRDNpM3o4RjY0R1Z4N2pBa0syVnRwSVJySjlwa0dCVaFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZnRVhKdDZEbUQ3S3VkUmRfcUFsSnpEV1lKNjYtcEF0o2NpZNkgY2ZMMm1vNEtWdGQ0eGhZVVdxdHRXRWJPeTRFaFpCT1I&ui_locales=nl 11 https://login.bitvavo.com/u/login?state=hKFo2SBJRDNpM3o4RjY0R1Z4N2pBa0syVnRwSVJySjlwa0dCVaFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZnRVhKdDZEbUQ3S3VkUmRfcUFsSnpEV1lKNjYtcEF0o2NpZNkgY2ZMMm1vNEtWdGQ0eGhZVVdxdHRXRWJPeTRFaFpCT1I&ui_locales=nl -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133602206882919628" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 3144 chrome.exe 3144 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3144 wrote to memory of 964 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 964 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 512 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4988 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4988 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe PID 3144 wrote to memory of 4916 3144 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mmg-co.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe410aab58,0x7ffe410aab68,0x7ffe410aab782⤵PID:964
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:22⤵PID:512
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:82⤵PID:4988
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:82⤵PID:4916
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:12⤵PID:3100
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:12⤵PID:3728
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4328 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:12⤵PID:2888
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3044 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:82⤵PID:776
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3260 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:82⤵PID:4520
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=740 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:12⤵PID:1492
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:82⤵PID:4300
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD57a219175b1f971c02dacec65c6e396e1
SHA11c4beb26e890e87020c2795cbeb8ef7836d50663
SHA256aedc429bb77811239139038267fe0d6ebfa11d5bca0b45b64220e37faf25c076
SHA512a4489aade5c4c50006d8c88a4bfb72bda92ca777a7deceddd50e4a876637e52ecfe1ac7804ad19183c66fbd0c4fafdd1ef74322d220b6acd9fcfd86fe392fe8f
-
Filesize
2KB
MD53132146ef31b490666c4f07885a8a6a6
SHA1ecc7c0239d03f6aff2fb8d9bfe9aab8ec0c5abb3
SHA25652956c6e4f775a399cf388a7d1cdc60110989f96830d39fb4865b425370c8212
SHA512325574ef0e839850e1c265fdd325ca777609b48b61d1d33711af19763823c39a8627fc08975f57b27e5dfa6d11b8aa4613c0790fbe4c14c19b0d3f1765c7d2d4
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
857B
MD5f56a43f0fc845b6458224fcabc556c02
SHA1a51f375c255904d6671435f433f05b69d692fb10
SHA25631dcd7e87c6918ecd2aa194ec33dc26c62e6abec2ba769b3645e365e41a80405
SHA5125282f9f54021768653f0d540b654a91340cfb4d6539562e2f684b2e331083972af2f24fa7e5d3e82a9c88813c441be843686154e9710515681eeae0773c0b058
-
Filesize
1KB
MD586bca320945fcd00462c81d6aa89293e
SHA1d84d950a04e3e3816fc78f54b306a82c3e449d2a
SHA25619c8141a8d18b2e5614a255d9fc91d19c63324adfd7527c51a9b30741bfd9ed2
SHA512fb0ddfc24696e5dcf2f54e0ba49df4d5a6056a53133aced368d948b945b134742a291859ff7cebd4d585367d33175871d8d52d2ad749fe1a664f7bb644536b64
-
Filesize
7KB
MD505e94d91c8d0fc98a19bd24b8ee3e51f
SHA16a1cd0949d74f4107a2d75eff938512b4f05be54
SHA25694bbd2817d409901c987b6fd9fe05e6b272b7bd671aec798a275c3de7abee717
SHA512a99b8e47dde27129434a057340d4212f2f5391a9e53428e6fdfdedf8843ffa910a0cc3d73b6cf4a5cc413ba92d29e55a1645eb2c3de7f07fb00549c50a01d6f1
-
Filesize
7KB
MD573f2b27cb6a90bba5970b0d7089a3678
SHA188b3a9c0aaf7348b4fda990fe452545c51c222cf
SHA2568ddf970c798f07fdb801d7ad048e659147ac52c38f92c4a61a9e9ae1eb0ebe41
SHA512f223d5dbd8c9f4328fe1db5551f151d72834dd625c8fc3974fcdbeffd5812ef26003b7742e99826a31452252ea780a5ec566beb66775408422e6a5694e5aca35
-
Filesize
255KB
MD5a7131cebef58175a69f0694f83d1ef5d
SHA1ab0a707b2f76c4ea289c47d249215b83c813444b
SHA256b79d125e26de426fdbd78b5b979c6e4b6497fbc95ec8f2a38f47f21d289a86e4
SHA512dedf8d804fd4a8efc7b36b64f34460d87a8af3db7ac5f2b75c2dcb77249f7f92d84ee751279d5df4b0c94dfe7ecf035f30847efb43e510b7b6799854cac2bd3f
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e