Analysis
-
max time kernel
1800s -
max time network
1685s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Google.com
Resource
win10v2004-20240508-en
General
-
Target
http://Google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608147791448840" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4828 chrome.exe 4828 chrome.exe 4568 chrome.exe 4568 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe Token: SeShutdownPrivilege 4828 chrome.exe Token: SeCreatePagefilePrivilege 4828 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4828 wrote to memory of 2368 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2368 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 3560 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 764 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 764 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe PID 4828 wrote to memory of 2704 4828 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Google.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9499ab58,0x7ffa9499ab68,0x7ffa9499ab782⤵PID:2368
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1888,i,17313467861589165116,15240712943545773022,131072 /prefetch:22⤵PID:3560
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1888,i,17313467861589165116,15240712943545773022,131072 /prefetch:82⤵PID:764
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2152 --field-trial-handle=1888,i,17313467861589165116,15240712943545773022,131072 /prefetch:82⤵PID:2704
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1888,i,17313467861589165116,15240712943545773022,131072 /prefetch:12⤵PID:5056
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1888,i,17313467861589165116,15240712943545773022,131072 /prefetch:12⤵PID:3208
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3920 --field-trial-handle=1888,i,17313467861589165116,15240712943545773022,131072 /prefetch:12⤵PID:3504
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 --field-trial-handle=1888,i,17313467861589165116,15240712943545773022,131072 /prefetch:82⤵PID:3304
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4452 --field-trial-handle=1888,i,17313467861589165116,15240712943545773022,131072 /prefetch:82⤵PID:2536
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1888,i,17313467861589165116,15240712943545773022,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD57088a82a6cdb26915be7101c96d81d25
SHA1405c098de93516de4ef61af4427837c368b65129
SHA2567ad8ffe7b5dd341d171c7d776e73b285c4029ddcf3103caf61063ef93619fe0c
SHA51237f3d9083f177d16fcacff9af80a0c42cd6ef4893d03ad11c582858969c70423e80ab2f92258a17d571e8a5de3251989ccdceb4868f45e3f4c257e6c606e21f2
-
Filesize
2KB
MD54961463ef9b066cb2d322e34b9c174ef
SHA1e8fb9ce1113db9f62efba68e4480482238e9611e
SHA25618b66f34632b04c7d7a1c9fe5e18ca8376720e5e8f5c3255a0b176bcbd237126
SHA5129c7456673e2f0fd59d532afa4aa9394187083f39cbc0c13788e530208c2e5f8bc01380aed37d7fae99ab0fcea19c92accc6dd3c92196a559c029bfce4fdedb1a
-
Filesize
2KB
MD53961b8eb79414eb6b8ed1238ce8317cc
SHA1b1d5be7a2a07e47dccfc86558a6baa595d25bf6d
SHA2568bdf10df8c4900cd7ab96fab2d89a26812d050c39fe09c6697812ce296e4caf7
SHA512605a4740935e63f07b4137c1f4ee507198c56d321278a54de456cf46cd458530d500b3d9db45dab31e133c50ee40e51ec01c8e42a17ba0834fc0fe46d2bb6589
-
Filesize
2KB
MD53104747aefc5b3611b12c1abb2b846c9
SHA1322bed29006269401a9697a8d58decd62fcd9ddd
SHA25674d1eb5f126efec14973cbb8e54b751b7c453257258f5a6012637768a4a74e35
SHA5120eb15131e260398b9f48c9539dbd710fd49ff49d93fa0dcd802ad30464371390d9577798f49625177d9df639d0b2b874a59a5e30309ccc5e0bb583d1cac1960d
-
Filesize
2KB
MD53321b6b8118a222921adf4010f7a38c3
SHA1845b31940934f4dac256d11900f7ab1314848c6f
SHA25688156fd00039076213216b2771b1e2bb248cd975ffb1c9b8052991b722a5e2e0
SHA512e4410647fcc15d9117feae6a7ddc1bb7a2c31a947c16db8fdead33f086c4d8712452c10989c3e93c427feeea6340b0e9fde007b149ac270f2a05b065e0b482d4
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD52d33a4b071ca7125bf1f21816f74fa5c
SHA1f64f5c38672f260492fab429f0d78215d451f912
SHA256927d6e41a0473c4f2c6e166a12e307ebdfb260300e1499c95419614b0513a947
SHA51239625bb4810fbf81b960daa0f5a22ac456cb207388abcf5a47c44c2d738a433c12a07ad51c3205c8c42c06ddd421623c7bd28ac7ff77c1d34120d0cd89a06e25
-
Filesize
7KB
MD574d36aa003ba0a969da2e34f41dd853b
SHA1cd17527c3cbc81329fb30c244bd1c383e1647778
SHA256277eaf0200963affcd89dcd46321cd4302f05e147922243510ed7eedad414938
SHA5128c4a8eaca07e25aaa5594759217ede8e7052c4a8aaad41bf629bd2338e2d414197a97d1ac04100b638dd5b6509c90d56e01b038b40a255bee2206ae398487117
-
Filesize
129KB
MD5b586a937ae3fcb934d28c15e927fedce
SHA1499c7419cc9991f0f70d07fd9e6fba85dd8b522c
SHA2566306b301e047330f90cc61a032ea7579b4be7aa9fe0315da2481ef43bf953290
SHA512236a13547328211c07a7bfd0ab08149f2fbbf6b2fb7b052352e41c6980cc3a4a1a7a0cd66c1e8141809048d352744e4eb1446d8d8c1232ffd96f3fa48df77c97
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e