Analysis
-
max time kernel
14s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://community.docusign.com/signing-7
Resource
win10v2004-20240426-en
General
-
Target
https://community.docusign.com/signing-7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609623838745998" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 3284 chrome.exe 3284 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe Token: SeShutdownPrivilege 3284 chrome.exe Token: SeCreatePagefilePrivilege 3284 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe 3284 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3284 wrote to memory of 3216 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3216 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 740 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 1700 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 1700 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe PID 3284 wrote to memory of 3364 3284 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://community.docusign.com/signing-71⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9303cab58,0x7ff9303cab68,0x7ff9303cab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1788,i,2207209814234631057,6123611717819542091,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1788,i,2207209814234631057,6123611717819542091,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1788,i,2207209814234631057,6123611717819542091,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1788,i,2207209814234631057,6123611717819542091,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1788,i,2207209814234631057,6123611717819542091,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 --field-trial-handle=1788,i,2207209814234631057,6123611717819542091,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1788,i,2207209814234631057,6123611717819542091,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4564 --field-trial-handle=1788,i,2207209814234631057,6123611717819542091,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
3KB
MD53f0888ba7a5b88984db69236806627ff
SHA15d20686a11c268ce06d5bd41677798b5b00509ac
SHA256834f961fd87b7e729f2ee16feb61ababe93878686b3b710a23ead091a56eb192
SHA5127e42d57874547a63e09f0be07b5ce30450a42c262e76fea99f1e272ae8c6c7afa48ea20c1de8aea1a0106b7cc81bd3cb709611c2df4e32311619e7a62d19eaee
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD57777cfd44f95c93460bf415355839774
SHA1a8ef87ae6422ada54d798b0c7a5198d4042a2ce5
SHA256a709c4a020bf27381df8fbdb38088eecaf71c64fc52eb8cf49b89fe3557b100b
SHA512abcd5731c0fb29ec4b25b68e689c5fb8610813694a9b4200d03ea91bb84bd2f56bc60783079064083e951f904d7d80084fcada5c9cef1f017dd990530289cdfa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD51dc20b39bb0159e68a98bdada6b926ac
SHA1e2c6fbe4e2b605c5b0c0ca29e7414217509d321a
SHA25619aedaee1b62081569e9cdeae3ecce13375c9f7317c63621286f76d33ff1953c
SHA512983e32b35eee6d79fb575390011326202b7a9018604b5ad61db06722e6489fd27edf8ddc41515bc57dc287f160d65b83898eab1d5054036c89c27555f7151a32
-
\??\pipe\crashpad_3284_GCLKSQXWIMOMVASZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e