Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://web.lmmoiz-4.cfd/
Resource
win10v2004-20240426-en
General
-
Target
http://web.lmmoiz-4.cfd/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608205798805218" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3280 chrome.exe 3280 chrome.exe 800 chrome.exe 800 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe Token: SeShutdownPrivilege 3280 chrome.exe Token: SeCreatePagefilePrivilege 3280 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe 3280 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3280 wrote to memory of 3472 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3472 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 3456 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 5092 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 5092 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe PID 3280 wrote to memory of 1236 3280 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://web.lmmoiz-4.cfd/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1147ab58,0x7ffc1147ab68,0x7ffc1147ab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1908,i,8586338443842511023,14096185400240377364,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1908,i,8586338443842511023,14096185400240377364,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2160 --field-trial-handle=1908,i,8586338443842511023,14096185400240377364,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1908,i,8586338443842511023,14096185400240377364,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1908,i,8586338443842511023,14096185400240377364,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4144 --field-trial-handle=1908,i,8586338443842511023,14096185400240377364,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3012 --field-trial-handle=1908,i,8586338443842511023,14096185400240377364,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1908,i,8586338443842511023,14096185400240377364,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1908,i,8586338443842511023,14096185400240377364,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 --field-trial-handle=1908,i,8586338443842511023,14096185400240377364,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD515eece3ccae36152bb9eaae85e62d2a8
SHA180849b3f357fdb2d55432be894465cd81bd4c740
SHA2561ca2633556a2fafb9d26c0c17ccf4de298c4c99bafc56a97e010fa4fa62b510b
SHA512577ac1709dbef4e320d8a22e4044a52c30833542ec6f2c5c9835a3c618efc282169e819fad37e96114d39a04bc8a96afc850de4f24584ccc6e299c644a7054be
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5ece829446a1955ec148af66a77cd03d9
SHA12b391572e277522c0f84480562d692f3a6726c10
SHA256822898652f52a81119e73b5a9e15261bde377bc2948bf32af2b16991569ec415
SHA512ecb2edb3c29964aab5e0c3553d2984ef43a7e02ce675e6175a6184b95d991c451171c7b22da31fdaeeb1d357b72614e02cee439dffeb7363b41105609a634031
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5dee46217b3c7001eca8484cd2da421c3
SHA1b60b252f6f9fcadca70ad829d02ec036d0171a9f
SHA256bbee364ef4bfe06833fec97b6b4d4ae1ace2bca08d70dbe73671b8183a7814f9
SHA512bda9d9fd6eebfadc949d057300279b74fd9a30e307adcb2053221e7d1e1090e6b6a3e6009c93e5818f85ed7cfaeef77c8cdcf02aaac77a3a1205ff6cf1c7ec7b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD532faa5f0a1e585488f84e92cff27222a
SHA19508a94e694edaf1c9007c78d030d11590603799
SHA25662ec15a6a32c4eb51e862be3715428d50a56f43afce351e926c574ba96f0eaed
SHA512ef0a9a5f67084d422e5b093c82d85b26868b05b87f6e40c583539a24cd52a690061a7c684c706127a40c3065fcd4f86ad9b1f1c37850f4aa821628874edb1355
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD54af5cd132187114639228f17b51925b5
SHA1522da970affa3d292241e5c39a9fc4cf7f0a11e2
SHA256bb9ee3acb12a43ecedc1bf83c78c349c20f1febd02d31ca3b00566e4240b121a
SHA512cbbae4f0ba1807cb3bb8029571777d0cf94e2328b16f167d0fd32b58cf2b55eb3320a91aae1ec3c4ce68e398472afb6a88613e49da0aeb7d5fe643afe9617b97
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD59cc2dd5ad94dcdcb97fbd9767e196a16
SHA17e4b8ed4f97b4185f41b2c4f68f480110a35746e
SHA256ebf0dc51f9bf8e26b42d25cd00b5f7ebf51a71903da9cf27fdcc019b281f6cce
SHA51266d70251faba703ab993d0ffe4243e542e0f921351eed828d185fcc93dfecf789933a898606ee654e2ed2dd75f362df279b70a003f3393d02169b8e7df8adf5c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD502733a4fbc9f7870ebaaf0f98c5bf5d4
SHA112d82747f9d8150fd4e67f3e79757672c93bf887
SHA2569700f49fe3bb0743ed46e90a43a8d8eb8eaeb3acb81c003cd60e6374dfb9e55f
SHA512cd1b7d2a4476ecaf1c61aab65158fa4574057d14b44e9cb7ca0fc1621ad5d492b85c957ec5be03f06068e0f3c554a724a8fcd6014887136982917d99ddd870e3
-
\??\pipe\crashpad_3280_XFWIHQADXKGIXABXMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e