Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://click.mail.virtualtrainings.co/?qs=4a0b46b9cf9a1c36377376564e74a2faa8c195c0dfe2c56bbb9cc072e44ff6a3c2508474909b5775cad2ded3fe1c101afec44561f693dc6db230c5606f7eb70a
Resource
win10v2004-20240508-en
General
-
Target
http://click.mail.virtualtrainings.co/?qs=4a0b46b9cf9a1c36377376564e74a2faa8c195c0dfe2c56bbb9cc072e44ff6a3c2508474909b5775cad2ded3fe1c101afec44561f693dc6db230c5606f7eb70a
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608220846589693" chrome.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1796 chrome.exe 1796 chrome.exe 1656 chrome.exe 1656 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1796 wrote to memory of 1564 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 1564 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 4568 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 3364 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 3364 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe PID 1796 wrote to memory of 2260 1796 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://click.mail.virtualtrainings.co/?qs=4a0b46b9cf9a1c36377376564e74a2faa8c195c0dfe2c56bbb9cc072e44ff6a3c2508474909b5775cad2ded3fe1c101afec44561f693dc6db230c5606f7eb70a1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0ab9ab58,0x7fff0ab9ab68,0x7fff0ab9ab782⤵PID:1564
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:22⤵PID:4568
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:82⤵PID:3364
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:82⤵PID:2260
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:12⤵PID:60
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:12⤵PID:2144
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4252 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:12⤵PID:3640
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:82⤵PID:3708
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:82⤵PID:2840
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2760 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:82⤵
- Modifies registry class
PID:4356 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2524 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7b4ba2fb-7427-45e6-bd14-af71f97c7c5f.tmp
Filesize6KB
MD51055ce3da10ac2de80d3be4767cb516a
SHA1207bd9da62a7d5dce25fc48bd93f54276d62a62d
SHA256a1ae1e2b51237ee9995505f00d213d2b247fda3e934abea88e3403b233eedb9a
SHA5122c80405350f99a9f56854a725636f8d23ad1adb9fbffbc3f95567a5bd3b6e05d5cf8464afef9255d448c6fa6a0b1e993d4346bd6fae863b71cd0f07494e626c3
-
Filesize
528B
MD5012afb986a2920611d85185f977f9a03
SHA1dc066762d990bf5ec2e7fd3363fb91d98cc62e7b
SHA256623e8f6c9e7b5981be59a4bf0037a6517217f8155f99b09d23c4035afe441b7f
SHA5122c54d29cb11e1538e8f6d31a65b814668e3f4fdc071c8d114fedbb709628cc5d960069555ddb836ea6ea9e2b311b9db2011ab617fb123d8fe29dfb97024a2a32
-
Filesize
2KB
MD5073e5bfddca03ee84acc507fd772be9c
SHA17713a5f663cf810904ded7e782c65702770cb49a
SHA256dacf64e3bf41de663b72f78430b57a43f61b0560eed3206b1248ca14e0a17d6a
SHA5123505961b9db6ed0b60a9a88a90f1bfb440ab25512492192c2b73f9d3ba9ff8b3725c607e6c29f211de16e15369600b4d1af1174d237a84917b3b9d19bb339647
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
851B
MD542b892a91e099a4f15351a6cd9affec5
SHA1ac92552b940dd1d2bd1ff241c6d6920d2a4ce899
SHA256f4b2f0b71f22d32a4ce74d0eb9e947baf531441612c8a761e813f4fe02a58b1e
SHA5122f3510672ed649b48bdd7d216f140b699a4df5a03bb1cf8c1af1ef9a0aa29aa8ca27225f5aff4def0dd64624a887bcc0ca339d9f36c43c0cb7a66a82a7995b1e
-
Filesize
255KB
MD57c4429f10f0a11eb427c16675774dc6d
SHA1524aa2c91fa71352a9909785d38e4b83233a3610
SHA25667eef1fb9879be4743e86420bec4955c3206cd5408ae1de464cd4da97d632c44
SHA512ce8cb686494e517c84e3bd316567392fa65bf440e459780959a2f24a1b101026758c4b689b912f4ef404db1c68dbd39aa708a78dec003d623a2adeb4e1b35053
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e