Analysis
- max time kernel
22s - max time network
17s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 14:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://shortlink.rf.gd/di6q25
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
http://shortlink.rf.gd/di6q25
Resource
win7-20240221-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral3
Sample
http://shortlink.rf.gd/di6q25
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral4
Sample
http://shortlink.rf.gd/di6q25
Resource
win11-20240419-en
windows11-21h2-x64
9 signatures
300 seconds
General
- Target http://shortlink.rf.gd/di6q25
- Sample240528-rt5zqsab65
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133613802248713852" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 864 4300 chrome.exe 83 PID 4300 wrote to memory of 864 4300 chrome.exe 83 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1036 4300 chrome.exe 84 PID 4300 wrote to memory of 1324 4300 chrome.exe 85 PID 4300 wrote to memory of 1324 4300 chrome.exe 85 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86 PID 4300 wrote to memory of 4068 4300 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://shortlink.rf.gd/di6q251⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6b4aab58,0x7ffe6b4aab68,0x7ffe6b4aab782⤵PID:864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:22⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:82⤵PID:1324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2260 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:82⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:12⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:12⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4256 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:12⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4232 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:12⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3216 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:12⤵PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4520 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:12⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4276 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:82⤵PID:456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1908,i,16089657028349593638,13869580568268010651,131072 /prefetch:82⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 d753d0ee8d328db3722fc191c1f530f0f556521aab1595a5ea606ac8bd792e19
- MD5 8cee0cf2530148af381e1ef47de43225
- SHA1 7e63aed6e59358c8b8c80892948ce432b97120b2
- SHA512 1c9c4f273b4ae50d5bb40241a32a3d4ac38da88530e810baaacf7b91a69241aea0a00b2ab9e116afeee0594cfaddb8cd2d4224c8487f96bfeef769174c4bf055
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 bf1d7968c928aca5df63900acef7c16dc2fbabf445f76408257adc6c0131e839
- MD5 2b68393ac4e7e7dedb27cfe93958ef2d
- SHA1 9bfb0a26655281a5ff2bbd0554b32caf189e62eb
- SHA512 d0d3847cf81bb6abf9700b7e9c490a76bd3e7aa721703089b2f04b1884ed13f286f99a0d03aa309f3e8959b48cd0da378c4b7c0c043fb635c1fd8e706474eb11
- SSDEEP 192:nNXshwawmaJao8syh+F8PYAUaoP5tjEsXtScR:nNXMOaCyq8PrUawtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 02a67d0eb2b4ceab509274e3617ec6da40e5aca4705a2134175623f1a8d3c217
- MD5 9ce7f1620422c8a35553da712d66dc49
- SHA1 a04691b37d34d0ad7d632033055b075b6b238736
- SHA512 1debbfde0603fbc7964cc2ca8ac7818d72563936e3f2e95d49cb3a0fcdc124ca03bbdb7304285f28b3847718cf24535b966237e0730633eb57c9d87bbd238a80
- SSDEEP 6144:AZ5IZXqXHjTdCP3y/9QYRPILxZnhLMJjX0EeGzY2rLm:IsqlGS9Q5fnReEFsLLm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 7cb2ea298ef547f2ead69a127d862e783d55830b4447e437f1287f1cc089b47c
- MD5 27a01d1b10e96da6fd93e5fded5cd02c
- SHA1 c3b79a503c36cb5ebcfdec3835c5a1b4d56aa781
- SHA512 e2e8f483d58511a0e380d8271fcca376e9770e1280ac684ff87be8218c51a67ac1ff4eaafb49a98a6cdb9f28925a764b473aa9e4dd40704e6c4c1ff6bc37f014
- SSDEEP 6144:hZ5IZXqXHjTdCP3y/9QYRPILxZnhLMJjX0EeGzY2rLm:dsqlGS9Q5fnReEFsLLm
- MD5 SHA1 SHA512 SSDEEP