Analysis
-
max time kernel
41s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://email.digimarcon.com/tracking/click?d=ab2R5GIPR4RnMi36N0yL-nswwqcJjxDShv96udVMt6C2MHc7kgU7mSvwVMTc8H5cOxmb0bw5zfnIlyE1O9ectEr_Bergaf1s9fRCM4Bz6FtHABRSO-pe4iRHugyYI4JQEPXRaN3khUZo3RcT76QFAuw1
Resource
win10v2004-20240426-en
General
-
Target
http://email.digimarcon.com/tracking/click?d=ab2R5GIPR4RnMi36N0yL-nswwqcJjxDShv96udVMt6C2MHc7kgU7mSvwVMTc8H5cOxmb0bw5zfnIlyE1O9ectEr_Bergaf1s9fRCM4Bz6FtHABRSO-pe4iRHugyYI4JQEPXRaN3khUZo3RcT76QFAuw1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608982112067741" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4944 chrome.exe 4944 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4944 wrote to memory of 4880 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4880 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 4412 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2184 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2184 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe PID 4944 wrote to memory of 2756 4944 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://email.digimarcon.com/tracking/click?d=ab2R5GIPR4RnMi36N0yL-nswwqcJjxDShv96udVMt6C2MHc7kgU7mSvwVMTc8H5cOxmb0bw5zfnIlyE1O9ectEr_Bergaf1s9fRCM4Bz6FtHABRSO-pe4iRHugyYI4JQEPXRaN3khUZo3RcT76QFAuw11⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff739aab58,0x7fff739aab68,0x7fff739aab782⤵PID:4880
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1864,i,4719071171824965117,2779411718966658438,131072 /prefetch:22⤵PID:4412
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1864,i,4719071171824965117,2779411718966658438,131072 /prefetch:82⤵PID:2184
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1864,i,4719071171824965117,2779411718966658438,131072 /prefetch:82⤵PID:2756
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1864,i,4719071171824965117,2779411718966658438,131072 /prefetch:12⤵PID:3996
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1864,i,4719071171824965117,2779411718966658438,131072 /prefetch:12⤵PID:432
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4240 --field-trial-handle=1864,i,4719071171824965117,2779411718966658438,131072 /prefetch:12⤵PID:3624
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1864,i,4719071171824965117,2779411718966658438,131072 /prefetch:82⤵PID:2252
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 --field-trial-handle=1864,i,4719071171824965117,2779411718966658438,131072 /prefetch:82⤵PID:2608
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4728 --field-trial-handle=1864,i,4719071171824965117,2779411718966658438,131072 /prefetch:12⤵PID:1712
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60fb1eb7-f578-4025-b6e0-0ad194df79d3.tmp
Filesize7KB
MD5210f48bb538569e2bc3e15c2c8d7de88
SHA1bb9e0fd85ff2a49f7b3373ffa794b98ab56259af
SHA2566b4bf12c9b9e5d57d7bdbdd2c2d80a794e09443e7301a4588a000cd09483e313
SHA512d7b45f378e50a5a87e50e27e2c3c3ab94934cab9493b8f7ed5c89a226daf458c861716f15eba1a0be2bc6e5cfdd0ea70a1fe212a56f6eebbba99b802455959f7
-
Filesize
2KB
MD569d9b2335ea111a96765118752eecbf0
SHA15c76ccca52c2dee46c58ecc5a1187e2f6920652f
SHA256d3313a9e3062b8ccd9d28b418f354c74186c28fe11fc6f0d8254beaff71e4ffd
SHA512d77d045b81274e9cdd9845aa1a542043992974ed837f53cf7606c4e9001bac54720eedf4375bce141d39b7194b0a0288d1a6e4822c13619b5ef8d60ce89a34c5
-
Filesize
1KB
MD5b4fd953b0c252e14262fcdee39da916e
SHA1e8af008ade816d2af8d657e2d33bdd44933bac89
SHA25647b3c8aac1e1cb7dcebc799ee8ec5407aa4a85681d294f67857b5b9a69c943e2
SHA5125a874bc79c1b5edd085b3267e16319679402933b03eeb1e618ed65b7d1cb5af53162c910a8e30d92494cf0bd9ddaf80b0725707f26e1ad42ef8710ddeb6d6f15
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
2KB
MD5f4efa1c21ae4af9e88c63c31d09eb203
SHA175fbdcb56f2774ae390c75c3b0fad6df90c441b9
SHA256779513343bfc2bf454ecf2b1daa97540dff7b83b1a077bb791de50ef5a59d427
SHA51279a0e2584397469fe2e2994affc97be0d5d9d2c8e2909fd0b7f37831d409e5c357916323d70d5c934c88b37c58d08937fae93bc2cf82897c0bc5172cc7bf3253
-
Filesize
2KB
MD5f81476dc7b79b5691090573f6ca9fdfa
SHA17fb96a5ea3307d0a25ddd42ed0270b5b7c241fab
SHA256936468a60c468fe523b0871198fa7a4fddf206b91e602e033006638a499fefbf
SHA512dae81bda1b2edcfec66684350851d24e22f3faa1a496645e93eea1a7df560c5a484d3f727719edf8b0b0c77ecab869786d5108a2ad7232c21d517934daae9a60
-
Filesize
7KB
MD5380b648d711a7b379ea703710ca25f6e
SHA1020153fc8d6658e39845741f25ab2e14d7f57f15
SHA25699167968adaa4e2f61b8c0b03618bf8cb0eb321eada14ab0ed80cdf608771c0e
SHA512228f82d1db705ccaa00419f52ecc5167ef7914405899e1a39e1fc53fd2dd78dcbcc66da92f41efdfc8a34dcd675758c33ed5e5134f3d75f4dc92f98fceceee7c
-
Filesize
130KB
MD57dfbd859d2d2ec2a0c4e67ea9ec83355
SHA1082b31a29549f90d296d724307956b80cd329e59
SHA2561247b779ed512db2589a5d19074118c9baa8dda300943e9b06363531ea2e612e
SHA512c1811825391e3726612646b3a054f9f5ddbe46e7143792fea6e945d10161ac8277bc45b9d0d77842758e140f34516fb103220b511cf67953f0ae7b87b1c6d837
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e