Analysis
-
max time kernel
300s -
max time network
273s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 08:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://appian.melair.com.au/suite/sites/asic
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://appian.melair.com.au/suite/sites/asic
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133616180870956203" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1392 chrome.exe 1392 chrome.exe 6044 chrome.exe 6044 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1392 chrome.exe 1392 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe Token: SeShutdownPrivilege 1392 chrome.exe Token: SeCreatePagefilePrivilege 1392 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1392 wrote to memory of 3128 1392 chrome.exe 89 PID 1392 wrote to memory of 3128 1392 chrome.exe 89 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4192 1392 chrome.exe 93 PID 1392 wrote to memory of 4972 1392 chrome.exe 94 PID 1392 wrote to memory of 4972 1392 chrome.exe 94 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95 PID 1392 wrote to memory of 4320 1392 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://appian.melair.com.au/suite/sites/asic1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff269cab58,0x7fff269cab68,0x7fff269cab782⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1924,i,14107346258555351891,1286369002931442037,131072 /prefetch:22⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1924,i,14107346258555351891,1286369002931442037,131072 /prefetch:82⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1924,i,14107346258555351891,1286369002931442037,131072 /prefetch:82⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1924,i,14107346258555351891,1286369002931442037,131072 /prefetch:12⤵PID:632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1924,i,14107346258555351891,1286369002931442037,131072 /prefetch:12⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1924,i,14107346258555351891,1286369002931442037,131072 /prefetch:82⤵PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=1924,i,14107346258555351891,1286369002931442037,131072 /prefetch:82⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1004 --field-trial-handle=1924,i,14107346258555351891,1286369002931442037,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:6044
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3184
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:81⤵PID:5416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD57bbb847e1ad545a880605e0544756dac
SHA16b4865d5d0344fb64fde3ac68f75eb5911d36f02
SHA256a4f1317e57880a00ae40be04ee6ca03a8e14aaa581410bc2dcd6071a0bb80e12
SHA5123e300f92992ae501cd11281eb662e36430301c902fb3943a96404c573dda6c8345308afe9dbb4019585940484c86fc162e36efa94cb2a9e769f2fb36f9bd1763
-
Filesize
1KB
MD596ad83d8c78e89e9cf02596204c1be23
SHA19a968a43cbae027b7b4613ff172623074ea85687
SHA2565688cd2f971dd2d5ae8a6e7e0ec4857cf9fed97e94b463ca2d5166c03ba328cb
SHA5123423a86d6aadb493be567dbca05fc3ab8264c9aa54e7b6f3374564fb8f60678bb67ca2b603f604e6ca4dfd53032188f97376db79a7e41263a48c014d883f319a
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD558306054f842a580be308a0178a256e4
SHA1e6276bacc318a0ef564d0e573332c54c7d69b9aa
SHA256f639a58aaa86ce230ee85e737520d058fc2016c95f88468e29e395e7ed0b833f
SHA512ec84abdb18521c02150d520385275187c30c25cbe9dcc760f36fc4f211d6f194ee6e422ee9ce3f12ea69fd13442dcca0cbdcbe474726feb3caa2598680c3f2ee
-
Filesize
255KB
MD5fff824e16e29dac61c078436bd34917f
SHA1367e4f0861fcc3373a872a2d21dd01373d2f85a3
SHA25669524727d4f3c86a6b29960aa08a72a9523ff92045c73be9b0daf6faad222983
SHA5120ac3e9e4a9012e13cf4ae12c4d9b6951948665721eaf28dcfbd6242a45f819febae5dee9f5692570327e92a463e11de6f04e625db88c068b95f9dbe01a5cfbf7