Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 20:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://xxxhotcontent.blogspot.com/2024/05/content.html
Resource
win10v2004-20240508-en
General
-
Target
https://xxxhotcontent.blogspot.com/2024/05/content.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133606228628123991" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4268 chrome.exe 4268 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
chrome.exepid process 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe -
Suspicious use of SendNotifyMessage 26 IoCs
Processes:
chrome.exepid process 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4268 wrote to memory of 1436 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 1436 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4188 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 3860 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 3860 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe PID 4268 wrote to memory of 4656 4268 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xxxhotcontent.blogspot.com/2024/05/content.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7cab58,0x7ffd6b7cab68,0x7ffd6b7cab782⤵PID:1436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:22⤵PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:82⤵PID:3860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:82⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:12⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:12⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4256 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:12⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4272 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:12⤵PID:2448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3124 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:82⤵PID:2288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:82⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:82⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3052 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:82⤵PID:3136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:82⤵PID:464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=1928,i,2498843550639454147,13155477518139535988,131072 /prefetch:82⤵PID:3976
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5b60496047755a73b33b1c3a4af07a079
SHA1767ff1fd7315aaa6a99a3ae7e8edd8ebb91e3711
SHA256b82c156eace96e9133402b33779bad00f9318a2d876d4d8b70dc7e4a53791800
SHA51279f3a5e9cc1bf07fb838990fc77626f903e47bbc1d96b74350f80b08380ae4875bbcad36d39ce93227b08cb175af21611e6e37db43df9d483ae9fce5de23e3b0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\70c27c56-7f3c-4278-b715-2aa30c55a247.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
856B
MD540c9fe29e7f0fd49d8ec37b79e80bce7
SHA1e85a34b9efa4d9219f7a8d4eb0b7e3677e8bf345
SHA25639c17f32eb593cd7c16075f1ce62e261bc4c88fd6cc4e8a230d316686e083c8d
SHA5120de9c73253bab4150fdb9d5699bcd481f8b24acf40d9b6a5acb388a1610b35caa48694f84abdd8e1b122646d80e201efa7c88e35cbeb6e37951039990d9db361
-
Filesize
7KB
MD5bed9416b7fe4d240588b945469623390
SHA136d5ec67f3ef71da0d7cd6fb8c3775a402c3ddf1
SHA2560915c2f88e489f680d3723dc2ca34cf93655a99685d32e1ef919e7b77c8b04fc
SHA51210a2909aab78387e21acc9a3c36942932909a3f0fadd1c5113b7b07d457f7f9a96aa2c6bc97af029e73c78cf96d930e934a87a4715f2662012d25d3aea8925cb
-
Filesize
257KB
MD54e12f8782de9c9dad7c28ea44488ee0f
SHA155adce44464ac6e2cf1bfa37ac7b2b214a8061f2
SHA256381b45ee7d679e15c018adba2ef82b3915fab470c96ff1d5fb3f32d43211db16
SHA512152a32332a0a962cb7fa019c3329c2dd212e794741249b35b37d0ec6c05a8388599a27c5f03a429a0099baa6e02653f965e2a93c8d5e377ef82e50f7b2171fd3
-
Filesize
257KB
MD56a2057d16e755658a6aa5f5690827686
SHA11ca10c107f017a59d1ae293c2d5355187e016ccc
SHA256af9bba17161fec0122e7fd52818cc42807f2f543795721a5fb75656f36575304
SHA512dd9a90e37626f59cdc5304e8164cb7d5629ac128de1145f35c0e46187eb07676d023aa8348fc0c98069171ea5c7da75bf04fc9dcabf817c648d39fad6630e252
-
Filesize
89KB
MD50bddb3fdc1b0297294a301438626417a
SHA108d2e099e9d6a423cf44142296926f649c539713
SHA2569bb004434be962eb6ccbdf4ece97d5918bc7918e985227cc90f34dd144fd1035
SHA512f9879d1cae34a8bcdab11bbf2d9637066d9081ba29e4b7c39f6b547997b832436c899577f85b99a364fa301c106ccdbffac6470a233195fe4d77cd7e932590fe
-
Filesize
88KB
MD5c80d29bb7888397eba5ad9c5400e10ff
SHA1b1cccbb3fef50e8d9363865c1b960a8266048b29
SHA25609a1f3b361be57ad4a599efddef9199668a1bf428024822d40746fc6f8c1959e
SHA512143b122e19c329f9e4f1dcc92b08b37055909b09eaa64921170689c43b7706e81808027976df04ed4bcd62a98ca92bbfb1775ac9bbd9c1d69ea20ede36bfd893
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e