Analysis
-
max time kernel
46s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 15:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://stcamcomnnunjty.com/gift-get/cardpay/gift/50
Resource
win10v2004-20240426-en
General
-
Target
https://stcamcomnnunjty.com/gift-get/cardpay/gift/50
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133615577260286798" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2708 chrome.exe 2708 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
chrome.exepid process 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2708 wrote to memory of 3520 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 3520 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 2020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 4964 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 4964 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe PID 2708 wrote to memory of 1020 2708 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://stcamcomnnunjty.com/gift-get/cardpay/gift/501⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6a6aab58,0x7ffb6a6aab68,0x7ffb6a6aab782⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1792,i,8997061718544075197,17392926802817665861,131072 /prefetch:22⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1792,i,8997061718544075197,17392926802817665861,131072 /prefetch:82⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1792,i,8997061718544075197,17392926802817665861,131072 /prefetch:82⤵PID:1020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1792,i,8997061718544075197,17392926802817665861,131072 /prefetch:12⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1792,i,8997061718544075197,17392926802817665861,131072 /prefetch:12⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4456 --field-trial-handle=1792,i,8997061718544075197,17392926802817665861,131072 /prefetch:82⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1792,i,8997061718544075197,17392926802817665861,131072 /prefetch:82⤵PID:4788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4740 --field-trial-handle=1792,i,8997061718544075197,17392926802817665861,131072 /prefetch:12⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD557613e143ff3dae10f282e84a066de28
SHA188756cc8c6db645b5f20aa17b14feefb4411c25f
SHA25619b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14
SHA51294f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176
-
Filesize
121KB
MD52d64caa5ecbf5e42cbb766ca4d85e90e
SHA1147420abceb4a7fd7e486dddcfe68cda7ebb3a18
SHA256045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f
SHA512c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96
-
Filesize
37KB
MD5231913fdebabcbe65f4b0052372bde56
SHA1553909d080e4f210b64dc73292f3a111d5a0781f
SHA2569f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
SHA5127b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD535cc0450dc4fd4464850f984bdfed022
SHA1063627bd326cd1b3b7f32504a3d3e64f4b63221b
SHA256b44bced65f45118d46f84479dabf21ebce7f9723b841eff04ce0eeecde5f15f0
SHA512b3b2330f5d69563c118285d193e8e34cdb1ae3168009cf3456a04d17448f578fcd506f7177b2a3564231768217a0a7a85f6a38d428b4b6fe0268ff440fc07751
-
Filesize
1KB
MD559de812cfd165f3c7a84ab8894151df3
SHA133027fc2899a1d573fa2930d6d5ed84b28296f68
SHA25672310d5d34d0d6e1bba28ac550d3070e15dc1a88a7d4bacc3717d1b955f670d0
SHA512e8e055c5bbbc05bbb382ca94a373c07f31e079d7980cfa1820e29eeb35ca3ef55ae5c2821c4f12068f68570082b52446c705eacd9eb529fdb1cf19a1e02ca36c
-
Filesize
7KB
MD5e365054e22023d999fa9b931d445db01
SHA18862091fc0b604f6ab548bda66273af93c7f6d92
SHA256f991467c52cc501586f33c65e9ed225105408d70ba72cd639236bddf3594e15f
SHA512655fd8db1e75b31365c3491c69edf126900acc30b7d7d3b3cd0d9fb07bf347c8e848f9f10f5b9262531fbf6e84f206c54a312120d2e3748a16b04cda3fe07dad
-
Filesize
7KB
MD5d6ef8fe55ba1e5c7a8c528d809720212
SHA11f847959933ff0969aa42c571595d7a0e274c085
SHA2569aea9a0b3ae3d523ac201169adbd6100f0afb0a861ee9efe2c13673c34856a10
SHA512311de0bfeb3c41cac5310e997e3a6efbe1ba5e72f3b455d3a268343af4e3db3b5418e90b285317024e3b7fae40eb7667e055fb1fa5eac4819b693043978d30e5
-
Filesize
130KB
MD5a7337dd0f4cc6c629c3b28f4468d99be
SHA1bda2704f574b985afd89c8c699f920b215eba0d0
SHA25622ab7734724d82706a059acef3406c51385dc875e43478fa1ce20cae593755cf
SHA512948fe0f577d44fd60fd362df4caf1a7aa523d212943788a04b9ea39267387be5d5130d97b57438bae177460b36f593523c2788daec16d994c1269c509d018a1d
-
Filesize
130KB
MD5c4d94aab2f1626517d4da0e76794ff11
SHA13a00dc52f588ddabd058f1484b5f7707361424bc
SHA2568e1b7404326067977cbf8b618185d5b0b622863a103b457a987e0511af788a79
SHA51238f96430c3e9b3c7611b0e1fa3826441538a9c661cb07eeea9a01286a6af36561c3113fe2d6beb9263d0b0ac893662f8828b8d74a3ca127b05fb15a8dbac92f9
-
Filesize
130KB
MD596c9794ee40b72ca95e6780e93297e83
SHA1ec4983ebe9c195c2744d0ae17953e429d0a94d0a
SHA256373e6dadbbe3689e4a7c999ee8c80fbeef30cb8e2947bd6fdf6ff57dee390f44
SHA512a89b50148037d08e0e05f61d7e8472923db680807fa2228acaf5806b8c96b571e1650185507aa162a5510f67ed99b468b46744a8d7b353ef296832f4d1b3aef7
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e