Overview
overview
7Static
static
1URLScan
urlscan
1https://myip.wtf
windows7-x64
6https://myip.wtf
windows10-1703-x64
6https://myip.wtf
windows10-2004-x64
6https://myip.wtf
windows11-21h2-x64
6https://myip.wtf
android-10-x64
7https://myip.wtf
android-11-x64
7https://myip.wtf
android-13-x64
7https://myip.wtf
android-9-x86
7https://myip.wtf
macos-10.15-amd64
4https://myip.wtf
debian-12-armhf
https://myip.wtf
debian-12-mipsel
https://myip.wtf
debian-9-armhf
https://myip.wtf
debian-9-mips
https://myip.wtf
debian-9-mipsel
https://myip.wtf
ubuntu-18.04-amd64
3https://myip.wtf
ubuntu-20.04-amd64
6https://myip.wtf
ubuntu-22.04-amd64
1Analysis
-
max time kernel
66s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://myip.wtf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
https://myip.wtf
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
https://myip.wtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
https://myip.wtf
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
https://myip.wtf
Resource
android-x64-20240514-en
Behavioral task
behavioral6
Sample
https://myip.wtf
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral7
Sample
https://myip.wtf
Resource
android-33-x64-arm64-20240514-en
Behavioral task
behavioral8
Sample
https://myip.wtf
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral9
Sample
https://myip.wtf
Resource
macos-20240410-en
Behavioral task
behavioral10
Sample
https://myip.wtf
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral11
Sample
https://myip.wtf
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral12
Sample
https://myip.wtf
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral13
Sample
https://myip.wtf
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral14
Sample
https://myip.wtf
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral15
Sample
https://myip.wtf
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral16
Sample
https://myip.wtf
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral17
Sample
https://myip.wtf
Resource
ubuntu2204-amd64-20240522.1-en
General
-
Target
https://myip.wtf
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 wtfismyip.com -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608820731860071" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4800 chrome.exe 4800 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 4800 chrome.exe 4800 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4800 wrote to memory of 4160 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 4160 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 3512 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 536 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 536 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2996 4800 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://myip.wtf1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe40a9ab58,0x7ffe40a9ab68,0x7ffe40a9ab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1924,i,11418773099898609746,15173027734819860805,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,11418773099898609746,15173027734819860805,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1924,i,11418773099898609746,15173027734819860805,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1924,i,11418773099898609746,15173027734819860805,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1924,i,11418773099898609746,15173027734819860805,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1924,i,11418773099898609746,15173027734819860805,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1924,i,11418773099898609746,15173027734819860805,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
523B
MD5e86fc9fcef9feb750855e9ad79c1e336
SHA1fe32c4e5f606a92cc7fecb169de37ab6aeb1903f
SHA2566ae1384855bd92f169f611a601e2ff6f868439bc6340b55f5e766637daef2a46
SHA51218ed557fc5386ca874556f7b02dbbb65b3b152d35b2e520afbd0365c0db5eed42fb8b488ba1025a3fbb2b087d175177989703a1a51011bfb0d1d7512ba1f84b5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5b8c0c18c08328fc41576edfade76de96
SHA1b49967eb5504ec62902d2c5124124d51e63e0135
SHA256081288ace9f1a1b10bb53357735775310cc2cbc9b2dd0cc2b1815da202ffaaca
SHA5127163fae089af5db635f0fddcef0cdc8061703d59d3d4bd18954bc5fb7defab9ee9ea110274c24e8a6b67db00065790f651469e769b67a1442129ab9f0c8b8fc1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
255KB
MD563cac23d8db3f5118f8ebfc4fbd0f7bc
SHA1bf3d39a1c86eebcdd414b529f6d1c85fa907fef4
SHA2562c00fd94d74db9af6d3d00a9f455441cf308654d83936dd67c909c56d9f0a0a5
SHA51272bbf887c666076b9f4a39a8fa2383ca8ba45a819a5a02389b808125aaf01dcda14d11072efe5810f12a6649a34d452e1b08da905d325fa62cf92c7f2edcec27
-
\??\pipe\crashpad_4800_LNHCZFXYLTAMDKCKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e