Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 23:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://streamz.b-cdn.net/K2.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
https://streamz.b-cdn.net/K2.zip
Resource
win11-20240508-en
General
-
Target
https://streamz.b-cdn.net/K2.zip
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608957465417582" chrome.exe -
NTFS ADS 1 IoCs
Processes:
chrome.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\K2.zip:Zone.Identifier chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4620 chrome.exe 4620 chrome.exe 2808 chrome.exe 2808 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 4620 chrome.exe 4620 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe Token: SeShutdownPrivilege 4620 chrome.exe Token: SeCreatePagefilePrivilege 4620 chrome.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
Processes:
chrome.exepid process 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe 4620 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4620 wrote to memory of 4976 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 4976 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 3536 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 1312 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 1312 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe PID 4620 wrote to memory of 2768 4620 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://streamz.b-cdn.net/K2.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd05faab58,0x7ffd05faab68,0x7ffd05faab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1824,i,599224513042319515,18040115762389371507,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1824,i,599224513042319515,18040115762389371507,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2140 --field-trial-handle=1824,i,599224513042319515,18040115762389371507,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1824,i,599224513042319515,18040115762389371507,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1824,i,599224513042319515,18040115762389371507,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1824,i,599224513042319515,18040115762389371507,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 --field-trial-handle=1824,i,599224513042319515,18040115762389371507,131072 /prefetch:82⤵
- NTFS ADS
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 --field-trial-handle=1824,i,599224513042319515,18040115762389371507,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1824,i,599224513042319515,18040115762389371507,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD58b5be88d9808887c20b1fa7974195557
SHA1f9436f2475eac344835f6831000bb14803931a77
SHA256ab3f4ed535dac38e9b9d449dd488d30f04470a43418efb7f7151da2d604b23d5
SHA51200e0ee33939eb28ada25aa58ab739be8163ffabdad45a805769bf9941e2fa1b77caa8e74ebd4a624f65d720c4012e675b33897627be7969510ae965222014df1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5ef900f8a819df0a5aef8c175db088e52
SHA1d650eba320739e6b6e121e73936b25f3ec9b1fe0
SHA256ddf8a0ce1e5334f456edbf4cf939d64d40c4d9e9114c151315edeecb911998b6
SHA512c79434c3ddaafeb7c29353d590e9e5dd196e3c167168feae820594b51debc665522858bc0a09efe5b5eb42e8a6d14b9564a64206e4971ad542b86e1faab4421e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
129KB
MD5c2259883cdc48fdf0a4c79dfc8b5e48a
SHA1ab1a8681e243a555ae32726433a8ae2c5603348a
SHA256eb2505779ff8f18994cdde089eb4d9e4fa4321d092db6bab11d1506c4d403157
SHA512e5c74cdeff287e608ca96e162a6be194a4a1851d4ec7a7ddf83ceaeac46783f07250cd475282e8330aca1ef12665cfe53969cd8022c2b721252e7b90df7540d6
-
C:\Users\Admin\Downloads\K2.zip:Zone.IdentifierFilesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
\??\pipe\crashpad_4620_FFXSXBUXPJFSPOWPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e