Analysis
-
max time kernel
71s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-it -
resource tags
arch:x64arch:x86image:win10v2004-20240426-itlocale:it-itos:windows10-2004-x64systemwindows -
submitted
21-05-2024 15:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://2.13-40-94-28.cprapid.com/POSTE/
Resource
win10v2004-20240426-it
General
-
Target
https://2.13-40-94-28.cprapid.com/POSTE/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607800479845772" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2276 chrome.exe 2276 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
chrome.exepid process 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe Token: SeShutdownPrivilege 2276 chrome.exe Token: SeCreatePagefilePrivilege 2276 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2276 wrote to memory of 1084 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 1084 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 884 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 636 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 636 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3768 2276 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://2.13-40-94-28.cprapid.com/POSTE/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f132ab58,0x7ff9f132ab68,0x7ff9f132ab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4372 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2284 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2292 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4300 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4540 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4668 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3104 --field-trial-handle=1664,i,7764045350446720281,4657616629788342789,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5a5b5f4f9c98ec3268861557b1a5ec443
SHA1d00fec3903a28b538293284ae03938b0c8f82b27
SHA256146baf285a9f19502a64a7d9f87b5eb0d9ed9f76fa83ea2d3cc83fe1a1f219a1
SHA51224588d5cd481f9362d4b3ae485e000c99b7920a035fe4a6f20ec36029a12f6c9f9a211500a72adb78e8f6ad8b128a1f179c604c91516cb04cab6b3729ad9cefe
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5091b3e2191e5a2ece27b639dac9c3e40
SHA1aabe25f3d3c2fe557a8e898a98ad87511219ab44
SHA256598acf90172f254697ea48e4e2adbf83232328c155b1e500f874c5c3286bfb07
SHA51295c85a705f9b9539fcdf836d5335219085674726298d98c4cd82595d1ecf07d78ece8703c8a75bcab585057f64d4a6df50cf886d061e82537136b21f51ca61cc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5cad8ff384363e9009ac40f6d5c0b7083
SHA188a148ad4e2ca270f99c904d48de93140264d625
SHA2567099e7f414e149f88aa9dcc3e97f1288ee7f8c50cc0e92d5eec65804bf5e6748
SHA512dc24be00c3c0000a26b43ad64be73f501796dadf3ffead57699e8e6d1fe075df469044e6d5ba9d2c675b7a8a6e4c72fd7969bb774ee6e295806a964fa87217c5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD58d98bdbe3cc34602ea2990b146203853
SHA140cc5e805cbdd10fab60b1619c89a484b1905193
SHA25699d2d68452b54e7458ac3e8ae2cdc2129a412db097d196f8e431506c0e41658f
SHA5127d2181b3abdbc6b8aa1fba298bc192493b0ec89f8ea4ff55d4da8f079e5ad9f3d405a3bb44c7d7cc1bb88e91a6446a2927abd88948343b054411b0cce67066ac
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD5413b06e48a6f6ce622b5ba64bc9cb4b8
SHA1506ff82d9b1567b57fdb0ee47ab05cf28050a440
SHA2562c93128e34a597c8322d2569bbb468e5240d700fad844feb7e24b3e9b36b1899
SHA5124a599aa7e85cba36dc0a1c453e6540f8378fd8fe05219657664846a6515f8aac215e4b250b27924b3ebd3ac833cdb7db13ee9a91c9d2763ddfd7262cc2678c5b
-
\??\pipe\crashpad_2276_CGZVFSXFIMXNVZBSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e