Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 16:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://685559321073766433.tvtrk.io/v1/2/Sjuj3KR_G6XOC-gJaHDzwCNjj6ATk3747c0j1M7-1fyCONh6-8PF_eG2eQAw_yWrRDV9EySuB_y6S0EMAwssV3TePHIBuQHJ6c4wH-_1-PQ!/dZPc4Zbbzp28hM_n0QKBsZ_TZFGpUXthgyscwqY2DL0!?tvci=dZPc4Zbbzp28hM_n0QKBsZ_TZFGpUXthgyscwqY2DL0
Resource
win10v2004-20240426-en
General
-
Target
https://685559321073766433.tvtrk.io/v1/2/Sjuj3KR_G6XOC-gJaHDzwCNjj6ATk3747c0j1M7-1fyCONh6-8PF_eG2eQAw_yWrRDV9EySuB_y6S0EMAwssV3TePHIBuQHJ6c4wH-_1-PQ!/dZPc4Zbbzp28hM_n0QKBsZ_TZFGpUXthgyscwqY2DL0!?tvci=dZPc4Zbbzp28hM_n0QKBsZ_TZFGpUXthgyscwqY2DL0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607819098109077" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1972 chrome.exe 1972 chrome.exe 3520 chrome.exe 3520 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1972 wrote to memory of 1172 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1172 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 1160 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 2056 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 2056 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe PID 1972 wrote to memory of 4548 1972 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://685559321073766433.tvtrk.io/v1/2/Sjuj3KR_G6XOC-gJaHDzwCNjj6ATk3747c0j1M7-1fyCONh6-8PF_eG2eQAw_yWrRDV9EySuB_y6S0EMAwssV3TePHIBuQHJ6c4wH-_1-PQ!/dZPc4Zbbzp28hM_n0QKBsZ_TZFGpUXthgyscwqY2DL0!?tvci=dZPc4Zbbzp28hM_n0QKBsZ_TZFGpUXthgyscwqY2DL01⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a1dcab58,0x7ff9a1dcab68,0x7ff9a1dcab782⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1924,i,11555568660981270238,17922687793748829967,131072 /prefetch:22⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1924,i,11555568660981270238,17922687793748829967,131072 /prefetch:82⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1924,i,11555568660981270238,17922687793748829967,131072 /prefetch:82⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1924,i,11555568660981270238,17922687793748829967,131072 /prefetch:12⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1924,i,11555568660981270238,17922687793748829967,131072 /prefetch:12⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3584 --field-trial-handle=1924,i,11555568660981270238,17922687793748829967,131072 /prefetch:12⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 --field-trial-handle=1924,i,11555568660981270238,17922687793748829967,131072 /prefetch:82⤵PID:3716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1924,i,11555568660981270238,17922687793748829967,131072 /prefetch:82⤵PID:3252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1924,i,11555568660981270238,17922687793748829967,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD58201fd489a10e173e214447e3203a01c
SHA18e5c81ea5d04955e0bbe3dd83abc93b8cd0ffe85
SHA256408c44c69faed6ce4c9a76fed01be1b984c6bbcf86f91af1962d1f2c51c822ce
SHA5122709e36769b9873e9d499fa563cf119df53849a0656096febda9141813378a94f79daa22cdb80c224180bedcccc6d4b126996842a4f843248907e974693ec490
-
Filesize
2KB
MD5250ca6eae219a775957dc4e397ccaadc
SHA199fcb41a5156cd3a793e7700923c513edacc35d9
SHA256f2dbb10101e370fb01594d0089a06d1ac98fcc5a62e2c6b8f1a11df7a75f1fed
SHA512a18d0a2af3750f8780d5a5ce09358dc1d65861803ef99e947273222bcf8d4d24453b328ada21555f2c18ee8d1c735bd98b5a183a7c77ac0ced406de04c7b0a8b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
858B
MD51ed83fa609ffdafcd87490893916f0e4
SHA1be0ad2559cf4d3020859dc5d91a88306ef8efabb
SHA25603bfe2ec79ff4060c44db9920525431f3b8eed3ed3746e3a075e7450a9a9a68c
SHA512a16b02f6b3a65f19736417cf0a02c856a3ebadf58304c0c4ab0b8d61ef754b1e9d4eeece23bde2bd8eccb4b9ceb6a2144ffa12fd73c2647b88069390c3ff8b25
-
Filesize
7KB
MD5b2c8b11fa165fee0c7b7b4463f1441e3
SHA15b979c1763af44130381dd7cb1143795716c5e03
SHA2561f80a80479fb7de06720976caf2be1c68f0bec56686227ba1391a1a06b1a44ef
SHA51245ec79ed3d674cb6051d7eab89ab8e8448f8bbda12077ed9d4d085db7f99615f9b00c1c8bfea4fee9df0bac208ca3d81fb10f5318700b77d4013b6014f26176f
-
Filesize
130KB
MD5b551d2d7354b6d497d70540678d3df33
SHA10ffc3e4799a25f4481f52465026b774469191bcf
SHA2569a1de4786347cde93da74a75e7d4159ca83dbbaa4fa74197650e6c5f8b9f433a
SHA512e586cf9ac1a78cc11cfb6c91fc88e5b6d27fe144e05e1d7ca4b5a2cd180d1ec306f273d6712347533034e41a824ca909645d459c4bbb76e5d1f730f9fda0a1c7
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e