Analysis
-
max time kernel
54s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://url12.mailanyone.net/scanner?m=1s9N28-0000qa-3G&d=4%7Cmail%2F90%2F1716288000%2F1s9N28-0000qa-3G%7Cin12d%7C57e1b682%7C11949542%7C14589158%7C664C7BD820EF00EA9CDA64C5861AF4A9&o=%2Fphth%3A%2Fctsroreseatmh%2Fmoc.&s=xD-G9sAzAP-Zf09cXzQztPkgBQ8
Resource
win10v2004-20240508-en
General
-
Target
https://url12.mailanyone.net/scanner?m=1s9N28-0000qa-3G&d=4%7Cmail%2F90%2F1716288000%2F1s9N28-0000qa-3G%7Cin12d%7C57e1b682%7C11949542%7C14589158%7C664C7BD820EF00EA9CDA64C5861AF4A9&o=%2Fphth%3A%2Fctsroreseatmh%2Fmoc.&s=xD-G9sAzAP-Zf09cXzQztPkgBQ8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607764609080702" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 1648 chrome.exe 1648 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe Token: SeShutdownPrivilege 1648 chrome.exe Token: SeCreatePagefilePrivilege 1648 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe 1648 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1648 wrote to memory of 1396 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 1396 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2244 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2580 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 2580 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe PID 1648 wrote to memory of 4324 1648 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://url12.mailanyone.net/scanner?m=1s9N28-0000qa-3G&d=4%7Cmail%2F90%2F1716288000%2F1s9N28-0000qa-3G%7Cin12d%7C57e1b682%7C11949542%7C14589158%7C664C7BD820EF00EA9CDA64C5861AF4A9&o=%2Fphth%3A%2Fctsroreseatmh%2Fmoc.&s=xD-G9sAzAP-Zf09cXzQztPkgBQ81⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcca3cab58,0x7ffcca3cab68,0x7ffcca3cab782⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:22⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:82⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:82⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:12⤵PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:12⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:82⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:82⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4548 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:12⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:82⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4052 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:12⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD5039007b92b2ca9f71f76e1ef3d9c762e
SHA1b00258a6d2f749cd16b6db105b37dec71cefc8a5
SHA2563921ed15c43536fc73458b867fee9ee39a70b95dc2e6d4590fec37ccff436ec8
SHA512eae7fb8aae8f407123e28487be9f8403371f770bb1affebb2d6dea26c9ff0549859ee59eeda97af44890dac11140a6be3eeea6bfd1d4b2bb797169971420d2c7
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD59f2b744a7cce6a6a0c4431370f661412
SHA1a73ec89ce12ddbc2e88c208551d28ec6988c8d2f
SHA256dc18e0feb5f7d5fda13b13959569056c58d0b9c530248cbbba02ab776943823a
SHA512d2465541364a60e137f8f09140e09ad5edbbba5b7b54d42a321512c6bc6e589a27661f2f79ab628c1a6b12b1260b5de0e5116a59c4592417bc5a978af31caffa
-
Filesize
7KB
MD526cdb29bcaf09d1afcea0e3a7e1c0705
SHA1a1b6b4152695e10b0f752efe6ccf1a5a4b2de978
SHA25655acd8cc3446b5fc47c7e255b2e76fd545c742b0016d1e35e741bb15122ef7c4
SHA512590d967fc0c02ff2e61f2d1884acf32ca4cffe1fb8cb2fb5cb38ccb8cab10ca3b33a067ee0604c4952c8e0aef9897f63dafc6b0c16fd4354fc8c8b1622c4cbd0
-
Filesize
7KB
MD52465701acf2312b1abd2d44cac4d5875
SHA14195dba8aa5325775a9861e8437beceb0a161d04
SHA256353fed9e16b83773f5d21ad7d57d6e708c269f0bb2591bdd3e5e17887e387d47
SHA512ec516c747edd91683294901219f4335168bdf004e92ce0ec040ee4e5cc99a2ad9b595f92bbc632717fb9050d440c2643b773b6d06506b312f4a634a322aedf20
-
Filesize
129KB
MD5cb93ccc18548fa7a51cba56ca25879f4
SHA16c7fa57989c546c30d91555c3878c755c96657ea
SHA256ecb4364cccc80fb5e10e1631d1545c50e0025fd66765ba613c4ebf039a1a386d
SHA5122ccc4f4ec400fa45acd4b37de6daba8b2bcc95c26072f80491c87df0a6b5ebecf39c1c463be4a0dd31793282574e30d784ed2fc9224ad42f4f8594b5339a309d
-
Filesize
91KB
MD5b4d14474461e30e2d581f860585d89fa
SHA176d724caf4df8d78b96ac734e09f1f64cba1b947
SHA2566fd2f6eed4c6a6f544a666659b49c169c11782bca2505681355839ef0e9e5330
SHA5128973bbc9662d60430ef7ddbeb33f8fa80482497e3868a045b258db80741ed6a58c1d773a9b941cb86f5b58bc3498b4ffb4b604b296ac1c220376b6fcfe60c680
-
Filesize
88KB
MD5e84909f20b16367b28e3d8eed407896a
SHA1519ed25707cfc67560af24a002e750fa69c8090c
SHA256172080e0a6b96ea3512e47315e1971f83c18cb548bce99a637d1cff237f25dfb
SHA512278dd2347b6abe024db5dc3be96f30cf479aa2cc55c4701e0bb1118f935d61cafa8a13d371e66884891498bb14929ade879feca437af97ae4f2d4b654df7dec0