Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
170B
-
MD5
f91a416be352a03c76b6ce8f948eda4d
-
SHA1
28f1cf539f855fff3400f6199f8912908f51e1e1
-
SHA256
7bc15a9ba71464596444ad648fa144937b848b302459c4103deae105cf42ce42
-
SHA512
9f08f3f47988a35936532d0bfb253be943e62bf6f5d886679be7e6403b15c8723bb5afce9bc0b4fd6b5c01571a087887c3ca2f515568797d15b53d8a40e4abc1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617711463527571" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 468 chrome.exe 468 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 2012 5104 chrome.exe 83 PID 5104 wrote to memory of 2012 5104 chrome.exe 83 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1564 5104 chrome.exe 84 PID 5104 wrote to memory of 1964 5104 chrome.exe 85 PID 5104 wrote to memory of 1964 5104 chrome.exe 85 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86 PID 5104 wrote to memory of 4088 5104 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbd88ab58,0x7ffdbd88ab68,0x7ffdbd88ab782⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:22⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:82⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:82⤵PID:4088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:12⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:12⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4228 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:12⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:82⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:82⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:82⤵PID:2160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:82⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:82⤵PID:3260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:468
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:5056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ac80eeda152de5c784d9b31cdefeeab1
SHA134bcf32ee4acad650570f19b91af667b308075e3
SHA256188f122f8ce340c341baacd266dc35651a59123d213454f3174ccb1100edf01b
SHA512603b790cac64c43dd66b924f21719ca8e1580e21c3ec471f4b84a0022ef0cd0602b96809ba7448b7e290f6d0ccd0b1c378735100d548bc6d000593d30224fe5c
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD59b52cf5e43a124447f40c6efb6c7a244
SHA1d8878da89112da95beae1e739eb6d43e09fc7bb9
SHA256cc39411a5d35c35fb44ebd1fac41e6a50e567d2226acb90fbcbd1020f0f9dcb1
SHA512a6e4d230f6eb4312df56f481aacdf8bfabb64ac0df0d75a99308f88415cd2e1edc07aea39f9c77219b12b4e7819bcf343b0e6e7a629867896255ea7ec927c1b6
-
Filesize
257KB
MD58774c78ef5dff199622826af88b2dba3
SHA18e60b18eba6b1bb1fa0469b7c446fedb72935af0
SHA2568d9ab8e412c03a23623a2270dc6845f73edf264b7bdbecd3ad6f365edd42748f
SHA512e0e8fd81fd031e3072cb34fde6f33813d77ed865f247aaf1022e152bd36338923075de4b7e43ff59e95c07bfc5b7b58c8fafa08fe8ac1fc26e672c334f07779d
-
Filesize
257KB
MD522f607cd4c50c03911b259a86763433b
SHA1d8cb55901a7d722886eb967674d4f3ec7c4ad005
SHA2569b7f90e10c7c7c4ae446ed12f85b44a5ea2a4e45c8b0cee2e7358bc0728d162d
SHA5129adf9a6f8ea53e0783a0d0ff2deba48952f30ce6a9f622d01cf7cb24dafbfb53003d282731c79e626239ab19b07b5a1cc27720f30b1b2fa1915f39291161de7e
-
Filesize
277KB
MD5986639098ffd343b885a4e8c2995d385
SHA1f1faa0d289b442bbc962fd5b8c14ed12fc734c97
SHA25620d1426d6a3b8c4380fe9f2033cf48befd1b267dace8020c2a2e64c0efd09e1d
SHA512d8258ba6c290791cc84485a09211f5cc13fe678ab726765dee06702129cb7dbe16e111213b2e7831ba933e1520a76e4c15f0a8cf84e5136227b3fa70d78ff721
-
Filesize
257KB
MD5a1c3825b19e5e489ccacdd827dae5674
SHA1beb0746e3da14494d801f21fca7283ce87189def
SHA256032ad285b917f11b1682809e8758333d6ecad58adc6756cc9d18201e9c19230e
SHA512afc47cf201a41a6dbe11cd915c666e944c54d13519c9afafe20f9cf1274cf72d429c204574f5ed5bf7d61d7bdaee4214bc6c0e2f3b97ebc1edaa71e201b5ee17
-
Filesize
91KB
MD5be008316a5b60ed556fda2f623a81aae
SHA1cf030900e08b2a0b63f33f8c0d995c0bf9dbfa8c
SHA2562d2be0a6576814a6604bc609c953f510fc4cef1dc26e8527e947bcd2a36ef3d5
SHA512f2fd0c4e70863d01d1f7e1c0ea3cccece82f50d5375be919a19d2939ade18a74083f59f9ca425771bed96cfb9099ec568ef630edd366f414d0d4259db0ca0cf7
-
Filesize
88KB
MD5460f2db51c1285bfe4cdcb3e3de7508f
SHA1b9c6c126d4e55531bd5fa3686d489006c03ba77e
SHA256f8987ca43c1c654aa895c830c40cb49fbfe73d3f113590bc3506c0964a984ba3
SHA512f5acd067ae5e35a3b8f415e680f1231a128223484fc4b086f6fb042a757568e9411dcf59e79d513a77273be00744e8b35fcf6a6fbe5be3bb9e2e121f429fb783