Resubmissions
26-05-2024 03:32
240526-d3yp5aea86 1022-05-2024 22:59
240522-2yrb9acc83 1022-05-2024 22:58
240522-2x3c5acc58 122-05-2024 22:30
240522-2e7vwsbd99 5Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 22:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ryosx.cc
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
https://ryosx.cc
Resource
win11-20240426-en
General
-
Target
https://ryosx.cc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609015408365657" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1640 chrome.exe 1640 chrome.exe 3112 chrome.exe 3112 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 1640 chrome.exe 1640 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe Token: SeShutdownPrivilege 1640 chrome.exe Token: SeCreatePagefilePrivilege 1640 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe 1640 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1640 wrote to memory of 1736 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1736 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1328 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1448 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1448 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe PID 1640 wrote to memory of 1064 1640 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ryosx.cc1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffff996ab58,0x7ffff996ab68,0x7ffff996ab782⤵PID:1736
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1796,i,10149379475084739496,12899728609141802284,131072 /prefetch:22⤵PID:1328
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1796,i,10149379475084739496,12899728609141802284,131072 /prefetch:82⤵PID:1448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2148 --field-trial-handle=1796,i,10149379475084739496,12899728609141802284,131072 /prefetch:82⤵PID:1064
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1796,i,10149379475084739496,12899728609141802284,131072 /prefetch:12⤵PID:3460
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1796,i,10149379475084739496,12899728609141802284,131072 /prefetch:12⤵PID:3496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4340 --field-trial-handle=1796,i,10149379475084739496,12899728609141802284,131072 /prefetch:82⤵PID:940
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4456 --field-trial-handle=1796,i,10149379475084739496,12899728609141802284,131072 /prefetch:82⤵PID:2656
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1796,i,10149379475084739496,12899728609141802284,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3112
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD598ca6621f23aaffe556a3bef34a69a4b
SHA10d4e2e59fc922b2f48bc1c1017088f18f5412392
SHA256fa7c5c3ae76eb9a8d04faa3df8f042a0b5025cc8c74734108c6cd4d3b1ca9703
SHA512841071cdbef940928a4f76cf4627d4e5d5bce929e9102f16fd4e1337c8c924962f31b29233d7be73f50677d3ccce1d5d98092d144240614b3173371c22439cec
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD57b9e6d011cdb090bb7636da6b89cbb20
SHA1a702a99ab8d49c1b4239ae66aac05c07ea6f836e
SHA256e9e892236dd2ace31dfc1471a5eb4104d540de72cbda5eae16103c7fa078ad19
SHA51214a8fc8905976a5f12a2d450eb281f92d3e8327ed1cbc1a4fd0fc4aa570c08b5af6bfdcf18988745308ba07feb63a31bf155e059b463b949c3e8c3bd97f00bbc
-
Filesize
7KB
MD51c09ba2a695a5286b54b7fbcc0bc4a11
SHA12b711f8d66641c72e9c603d19839ab9bc3b2fb5d
SHA256d8f5c51332822849b65db4282934c9e5137b5c3a71ed097c17636527272f78eb
SHA512ed827603341a9a5f5b181bfb8e2deb1cb0ed2bc3af6d06bc9e7082ce0bc2b16327ee8f1fb3409ec793c26d221c2fb8cf736b3367c7cc57d8a2aecf1af275da71
-
Filesize
130KB
MD588a327f24350c4f296ee9961d241eae3
SHA18c2e68483d5c3ffc260df4db0ea186f7c19d3587
SHA256ec5cb8b72045846a2b131d2134d0b698176898720a3cc0e2db200b966d5d5173
SHA51218bff5d8d45b7455bb407829c1bc0d88bd4573bf07f05776cf94e8932f1616e38ac4a5038137abe831d510a8c39e59af533f3ce8b39e7dddb13b96be8603cfcc
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e