Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://securemail.lkcm.com/formpostdir/securereader?id=wQOkubfjlkX5CUeZbMHFk6sMFuqMJtQp&brand=bfc5548d
Resource
win10v2004-20240226-en
General
-
Target
https://securemail.lkcm.com/formpostdir/securereader?id=wQOkubfjlkX5CUeZbMHFk6sMFuqMJtQp&brand=bfc5548d
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607969732481587" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2876 chrome.exe 2876 chrome.exe 3720 chrome.exe 3720 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2876 chrome.exe 2876 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 3064 2876 chrome.exe 92 PID 2876 wrote to memory of 3064 2876 chrome.exe 92 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 4628 2876 chrome.exe 94 PID 2876 wrote to memory of 740 2876 chrome.exe 95 PID 2876 wrote to memory of 740 2876 chrome.exe 95 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96 PID 2876 wrote to memory of 4948 2876 chrome.exe 96
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://securemail.lkcm.com/formpostdir/securereader?id=wQOkubfjlkX5CUeZbMHFk6sMFuqMJtQp&brand=bfc5548d1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xec,0x108,0x7ff997dd9758,0x7ff997dd9768,0x7ff997dd97782⤵PID:3064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1796,i,7716739978247427445,10733535491243864930,131072 /prefetch:22⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1796,i,7716739978247427445,10733535491243864930,131072 /prefetch:82⤵PID:740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1796,i,7716739978247427445,10733535491243864930,131072 /prefetch:82⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1796,i,7716739978247427445,10733535491243864930,131072 /prefetch:12⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3168 --field-trial-handle=1796,i,7716739978247427445,10733535491243864930,131072 /prefetch:12⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1796,i,7716739978247427445,10733535491243864930,131072 /prefetch:82⤵PID:984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1796,i,7716739978247427445,10733535491243864930,131072 /prefetch:82⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 --field-trial-handle=1796,i,7716739978247427445,10733535491243864930,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3720
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2284
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:1940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD51c5c3d1dbd1782a8913ac51f1d0ca696
SHA1de4b6fb36a5597cabd7fa4637d8d36c292935a98
SHA2562ac7b07332492ceda5040dce9e490a5d22f66f34a162569d4b58262c468926ad
SHA5124744acc954119e357b9335d7e9950d54b598403c471d886ffc4da81ed442f64667ef509b3bf0417058b9562571a1e1d3f77beb43b1489e7959aa988dea894e15
-
Filesize
690B
MD522a663e8f328216557b633ed27d3a050
SHA1726c2a88afb0ad3f830dafe97c4aa84f9617bd77
SHA256da4f3c3425262e055053b28a867fe233172d3ce30d275f50ea4b6ecff379966e
SHA51296fb51954c204015f921bace33b9f75d9ab3e0e97a8a92e6c0368b8ffe7c40858dc6067982398b18ec0cf456e7b07d3f9ae80b3c91ab1717a0b8555ca8882969
-
Filesize
986B
MD55a9b5e28abdb5ad6d58988d71cd25c53
SHA1f615e6d9ff14e7acfd28eb6c48811a502bd81b13
SHA25699050ae67e4bf81ce39e916f6147c740591659a65a8c8ff444f3a4868f91f029
SHA512c150545eefdf1cf59cb2fbfd550c1d06709889b2738090c4cd3e0c8f337a791f0252d4f16313d592f5302fc4d53acb85c06e2b2840bf15669422503d4baab005
-
Filesize
536B
MD5d7301b65341b848086c64c7c09bdd4c0
SHA103961275b377af79061fa8b88bb4db0316f59128
SHA256048e84853ef9a5d4c9f32198ea39bc7588bb49a87bfe64bb77cb9e19b93f5c95
SHA5122cfd0fd6748e65680122b6901b9a08160ed40a0f5afa4db7d879313bc416e6408d6239199447556ecf7f3b317fd0cdd698723dd1fc42a0bbfd22eefa8c0b2a8a
-
Filesize
6KB
MD5f42b2c8cc0a892ed44ffa612be178888
SHA14bb3be986a8bc8bd707ab2b121a68a96066a320a
SHA256fb373ada879cf2bf2145b758ceee471d36bae1052c7bb433496459f0f44a07ae
SHA51288614a32fee2548fef6d960bd312adde80acf0b7f0b6e3adc283a8309540e36b902dab2dbd825d8a419fda17963205d385e1d061f60efe04e19d4ac2c70a44a8
-
Filesize
6KB
MD5be4388c88eb73b40abbd1682601735e8
SHA10ed398e2419dc21993c7c222c9ee447439838d93
SHA256c3e8228e03fe1a83a2eb039cb0da3a316bc3314f7073542df1e4440d4aa5ad3d
SHA5123c7a8ee25aa93bd6365c9b8f322fb7b363d700b980dd3733ae996ef74c6b919dbcaf4ab259f706cc5499fb594c73b929464c9f895dde9bab1296ac497df53eaf
-
Filesize
5KB
MD584730cef06154c8621c7a4e1643dcce2
SHA1b583222bf795396bba21d67910c9af7152b60c5c
SHA256bfcabbea26c0ae8b3e9f8601c5607adf8fd8f349520186b3b96de3951ae32cc0
SHA5123e4169d705d64ae05ea6ba04346c949b1c383e06ff489f3279efa183c5d93e4c18f0aa77251320923c7db474c8ec2cf91802d66e4094f8fc29673ec66b4f9ca0
-
Filesize
6KB
MD562a9f43e4542642aa86b0c484c6cfd74
SHA1f9312c62983249c0a41ff814edc91ad126c159b3
SHA256db1c3dfdb090dfaeab4c6bb1783bcebfa5106bed01ee08e06f88fb9ea1eb3735
SHA5126287f012d1df460d477e014696eefcf51d168e3f0575d986be38cfaba4b17a415535aedd58f1e3bc1ab18524313b381976cfdb449da65752ca3a779fd6b9ade1
-
Filesize
128KB
MD558186ab49bca2c5eab93539b4d68718e
SHA12a159a475799826ea8cb4e5dbb4ddb9a5023575d
SHA256c7e170a17e0e0ee56b029219757b104c586187a154f854ed53a4f14e0e7505b6
SHA5120899980ef93c15d229c9027e1b850aed8a93365c6abbea21e9ca2b43e0f522a893a1f5ac9785d30f2933bb6ad5a4ecf6b6bd1bcf76c39916effa772c1c11720b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd