Analysis
- max time kernel
31s - max time network
32s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 15:35
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://rayeje.abliplog.com/TmLE9n/#[email protected]
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target https://rayeje.abliplog.com/TmLE9n/#[email protected]
- Sample240529-s1ea2abd36
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133614705241193236" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1584 chrome.exe 1584 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1584 chrome.exe 1584 chrome.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe Token: SeShutdownPrivilege 1584 chrome.exe Token: SeCreatePagefilePrivilege 1584 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 652 1584 chrome.exe 81 PID 1584 wrote to memory of 652 1584 chrome.exe 81 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 5028 1584 chrome.exe 83 PID 1584 wrote to memory of 924 1584 chrome.exe 84 PID 1584 wrote to memory of 924 1584 chrome.exe 84 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85 PID 1584 wrote to memory of 4352 1584 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rayeje.abliplog.com/TmLE9n/#[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9303cab58,0x7ff9303cab68,0x7ff9303cab782⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1924,i,10020942929717888074,14845833870296017086,131072 /prefetch:22⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1924,i,10020942929717888074,14845833870296017086,131072 /prefetch:82⤵PID:924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1924,i,10020942929717888074,14845833870296017086,131072 /prefetch:82⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1924,i,10020942929717888074,14845833870296017086,131072 /prefetch:12⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1924,i,10020942929717888074,14845833870296017086,131072 /prefetch:12⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=1924,i,10020942929717888074,14845833870296017086,131072 /prefetch:82⤵PID:2960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1924,i,10020942929717888074,14845833870296017086,131072 /prefetch:82⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 18412479018fe806fc026ab29710b2f05d2b6d514b2034b1364e27bcd7b21bbb
- MD5 ac5692bbf04e2e402c426e944cf32d1a
- SHA1 8316cb79f99352c0d8f78154d8ee48056721a4ba
- SHA512 e6a2efa6044e3e6f8a1d46f9ec7b863d03b95ed05b5723488671cafcf23348b687986f8230a8bddad44b8ac741b184b74f5236658110779f3bca2b9b1a155ba5
- SSDEEP 192:dOn/Ay+i5aJN8w8syh+FIKAAFP5tjEsXtScR:dOn5+PuKyq9AATtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 0be475692a7c7d22d99ddd35a0ce14c6fe8fe040da21398209cafad86b1662ed
- MD5 6911e8ef4e6972a46d40866926822724
- SHA1 37ada4655238a0b7548edcdf7774bd6d0190c514
- SHA512 8ae3129b4ea446c9d63fc6df24c4c89263ffea9c6a941182744e215e793c5f86b500bdf53a0fcdcf8b604cd0cd5770f6bb1b3ff65987d97e9045397e493880b1
- SSDEEP 3072:S3zgZoOqJ72dxqXQqd+9z7MAHQDgOnwy56J/h:S3cZDwwHNHQm
- MD5 SHA1 SHA512 SSDEEP