Analysis
-
max time kernel
34s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 08:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://docs.google.com/document/u/0/d/1Qxcc-LbN8wB8IuQ4bFMgbwSq3ErYvzppJQa09yRL2W0/mobilebasic?pli=1
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://docs.google.com/document/u/0/d/1Qxcc-LbN8wB8IuQ4bFMgbwSq3ErYvzppJQa09yRL2W0/mobilebasic?pli=1
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133615314064258856" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4676 chrome.exe 4676 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4676 chrome.exe 4676 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4676 wrote to memory of 3128 4676 chrome.exe 81 PID 4676 wrote to memory of 3128 4676 chrome.exe 81 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 4892 4676 chrome.exe 83 PID 4676 wrote to memory of 3856 4676 chrome.exe 84 PID 4676 wrote to memory of 3856 4676 chrome.exe 84 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85 PID 4676 wrote to memory of 632 4676 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/document/u/0/d/1Qxcc-LbN8wB8IuQ4bFMgbwSq3ErYvzppJQa09yRL2W0/mobilebasic?pli=11⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd92bdab58,0x7ffd92bdab68,0x7ffd92bdab782⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1916,i,9884350906072169468,16406195796616620662,131072 /prefetch:22⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1864 --field-trial-handle=1916,i,9884350906072169468,16406195796616620662,131072 /prefetch:82⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1916,i,9884350906072169468,16406195796616620662,131072 /prefetch:82⤵PID:632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1916,i,9884350906072169468,16406195796616620662,131072 /prefetch:12⤵PID:2852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1916,i,9884350906072169468,16406195796616620662,131072 /prefetch:12⤵PID:2904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4412 --field-trial-handle=1916,i,9884350906072169468,16406195796616620662,131072 /prefetch:82⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1916,i,9884350906072169468,16406195796616620662,131072 /prefetch:82⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD507a892a76878e3d63d759d6aea804247
SHA1af2f1ba9abefc77869b19005fa359d68548917b0
SHA25662b4e4d650300d6a0df01212b539b3b86b583448f985abfb90c815c7e5974f78
SHA512702d394c744811a7765c1efa8f367f28da080ce265c94c59ae8d5a31c98b3514a21dee528c09e9573a1e2372d103ee48a07db9239ff571faa47a1201b92ab2e4
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD58318fca6e3602d33a7c493c27d8890b2
SHA195bade81b536426f46f7e70dfe96c21e038269bc
SHA25664fdc3948319e35297cfc5879a9f802b9a432e265ba5029d746bd17879e77067
SHA512292773b05ed2f0acafaae4d265511951992c91a15a9b3b51b495e6732e8350d6b450ecab2dece6a6e13e62d0a3bb2a4b2faba7e4fc99b1f2c3fca471390aefe3
-
Filesize
7KB
MD5c3ca4054798d56656501ce4d460a69f9
SHA18078b602597942f95b659b7ab276a89dd5991d00
SHA256664d10757482994c83b5f16235a29bda44b6e4c44e17b9809b11888ead3e192d
SHA5123de80dac67e3d47198e88848feb04cef4330ea2326a2604df434d91ed37b90913314e535d4255af7e600a1a5423082500f77756b6d3a0f3ee07d7363bde0f517
-
Filesize
130KB
MD5cd3517c4d808620e525f8e82f2aa5882
SHA1a895974c45ffb5505bcd4afcde9a89e1ed03d39f
SHA25645336aa0b50672f9950ca6032635fe6504fe91c22ca4c425efd596eeb0a42ee1
SHA5121a8feddb48021e0c2b7ffc3cf3265c5e25e6cf8a9d1b74e022382ce356d01bbb20cc2764708fb62126d0ab63b2c044eb7d15b3f2b4902c344cf600e9ec320a70