Analysis
-
max time kernel
119s -
max time network
113s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
23-05-2024 00:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cfr-cicc-carb0n.online
Resource
win10-20240404-en
General
-
Target
https://cfr-cicc-carb0n.online
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608992254816083" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 1340 chrome.exe 1340 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
chrome.exepid process 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe Token: SeShutdownPrivilege 1340 chrome.exe Token: SeCreatePagefilePrivilege 1340 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe 1340 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1340 wrote to memory of 1596 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 1596 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 3156 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 368 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 368 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe PID 1340 wrote to memory of 2708 1340 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cfr-cicc-carb0n.online1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffab44c9758,0x7ffab44c9768,0x7ffab44c97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1588 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2036 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2828 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2836 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4264 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5112 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3060 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3724 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2392 --field-trial-handle=1708,i,9624492706771439858,17338128692486270041,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD50cefa4ee8291c85fc1354c2f2376c32b
SHA1930a60f1ae1fe58b62a4efee0129eca0f9a9e9dc
SHA2560d426768a6c3fcf66524b1291712d1f8f6b968f73c913cd48fd65bbc888e5676
SHA51253a61c35642a916ec08c71a21a6b7da55b29677f7547221321b4c7b979ae078fb346c87225bd359479c1ae2429d706b92fe059ca9bd70419d055fc2a075c60f8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD595f99ab8dfe22bf34c4a96385cb4a939
SHA10b459e994cecbb62dfae95449fef58ba657ae469
SHA256a6d26f75157219a8c722ce7a5a1c82f5c9aeb343056f1a5311c2f93f868e46b1
SHA512517b13874a684b071b1e65f333935c79164cf20fbb343411a2fff09bdee1613d92099daf0d445c74f0d6017a05e67a74365e79c580ad8e31114b0fe8ce484d35
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD587c4259f764bdda7232071b82f96137c
SHA19a59c41cf154dd54a16beb57a6599e760e92e768
SHA256180a3b9983ee012e9dc5421b6622fc56beb1eddd54726e807a2560408f177463
SHA512320d3b170675be8a1a7f768c3fa29c6aae7157aff76a0a13ff982d0a56159fb1eddf5172f58ec5600d0fbec86c5fe70c75947a182ad33e7fbe628c191bf5558d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
136KB
MD5c375d769a97016cc2011c8d1fe7011a9
SHA1fbf257141b4183ff468843ee0391b9a8feb91b8b
SHA256b32fb05fd25ee29a8cef28065061900f659eb4e89479ffd21a985f0bb58da42a
SHA512b1a36cb9cd47a3e723a2a35ab0ce8aec3ffca270b2039fad1d2f00e186b6583de7332bb138ea6b86eba8496217bf4a768bbcd2d97a87344e6c62c9cb7d939978
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_1340_TIFODNJVFBKLMQKPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e