Analysis
-
max time kernel
34s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.google.com.bh/url?hl=en&q=https://www.google.com.bh/url?hl%3Den%26q%3Dhttp://www.google.com/amp/www.google.com/amp/www.google.com/amp/%252574%252569%25256E%252579%252575%252572%25256C%25252E%252563%25256F%25256D%25252F%252534%252562%252575%25256E%252561%252536%25256D%252575%26source%3Dgmail%26ust%3D1716381346370000%26usg%3DAOvVaw39qi1B982qcBSEltjNS11Q&source=gmail&ust=1716381380814000&usg=AOvVaw3muIRvMOaT3Osl9-QTLv6k
Resource
win10v2004-20240426-en
General
-
Target
https://www.google.com.bh/url?hl=en&q=https://www.google.com.bh/url?hl%3Den%26q%3Dhttp://www.google.com/amp/www.google.com/amp/www.google.com/amp/%252574%252569%25256E%252579%252575%252572%25256C%25252E%252563%25256F%25256D%25252F%252534%252562%252575%25256E%252561%252536%25256D%252575%26source%3Dgmail%26ust%3D1716381346370000%26usg%3DAOvVaw39qi1B982qcBSEltjNS11Q&source=gmail&ust=1716381380814000&usg=AOvVaw3muIRvMOaT3Osl9-QTLv6k
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609620241957475" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4404 chrome.exe 4404 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4404 wrote to memory of 2776 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2776 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4784 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 744 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 744 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 2912 4404 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com.bh/url?hl=en&q=https://www.google.com.bh/url?hl%3Den%26q%3Dhttp://www.google.com/amp/www.google.com/amp/www.google.com/amp/%252574%252569%25256E%252579%252575%252572%25256C%25252E%252563%25256F%25256D%25252F%252534%252562%252575%25256E%252561%252536%25256D%252575%26source%3Dgmail%26ust%3D1716381346370000%26usg%3DAOvVaw39qi1B982qcBSEltjNS11Q&source=gmail&ust=1716381380814000&usg=AOvVaw3muIRvMOaT3Osl9-QTLv6k1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe6c3ab58,0x7ffbe6c3ab68,0x7ffbe6c3ab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1980,i,6595586468270176257,2039250682026482610,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1980,i,6595586468270176257,2039250682026482610,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1980,i,6595586468270176257,2039250682026482610,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1980,i,6595586468270176257,2039250682026482610,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1980,i,6595586468270176257,2039250682026482610,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4368 --field-trial-handle=1980,i,6595586468270176257,2039250682026482610,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3408 --field-trial-handle=1980,i,6595586468270176257,2039250682026482610,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4492 --field-trial-handle=1980,i,6595586468270176257,2039250682026482610,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1980,i,6595586468270176257,2039250682026482610,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4496 --field-trial-handle=1980,i,6595586468270176257,2039250682026482610,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
692B
MD50f09a5d8133f897763939f79a7ab0e36
SHA1f54c38080a5a87b9ba725a55e7519636f6420925
SHA256ed16c8ec9e1517c60ad40308b3067058595a3829456100a43f60c93ab1fd68f4
SHA5120838ff619fe51ff4839a02e702536c2a6b1b8c23822d4b253576a8f8dbeea82c0e26818801e00c7ee24a6051214a93cfcdab4ede70ceabd65ec1ef37f727a348
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5437f4aa863a7dd666f2a35e0ab94ba04
SHA18b9fd75c42102811db6aa5763ea0b491dbb56fc8
SHA256fc6b99c0975834d7eadc326d392b9efbaa442d6c74d112246b597dc56aae53d2
SHA512f6618b7af6280ad487b3a42c2bb215d2978bf96d0584ae8852cff990ba3ac59d6fdfb03c77c8676301555ea6b1af3511381ef82452306455301f8f9ef365c489
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD5d8e639d4595506763cf6d0c18fb1955e
SHA1c60dff892f86b1259825961a7a5ea5e2ba57ed92
SHA256b255af3839e0c3e622edddc837440232c6f5a9d048d761d72de06e8670da8300
SHA512a689da5c7c745681c2edf867d8e851d80e01c680639c43649edafe96a850b1fc180f52fa44c807e650eb51097827a28fd8c7879eff3ec0df671819e449f8bdb5
-
\??\pipe\crashpad_4404_IXQOXGBXQUSKNNKWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e