Analysis
- max time kernel
300s - max time network
290s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 05:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://servicesautralia.com/message
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
https://servicesautralia.com/message
Resource
android-x86-arm-20240514-en
android-9-x86
2 signatures
300 seconds
Behavioral task
behavioral3
Sample
https://servicesautralia.com/message
Resource
android-x64-20240514-en
android-10-x64
3 signatures
300 seconds
General
- Target https://servicesautralia.com/message
- Sample240603-fxa3zscg2w
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618652940532998" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe 732 chrome.exe 732 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4640 wrote to memory of 1568 4640 chrome.exe 82 PID 4640 wrote to memory of 1568 4640 chrome.exe 82 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 4716 4640 chrome.exe 85 PID 4640 wrote to memory of 2916 4640 chrome.exe 86 PID 4640 wrote to memory of 2916 4640 chrome.exe 86 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87 PID 4640 wrote to memory of 2676 4640 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://servicesautralia.com/message1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d08ab58,0x7ff84d08ab68,0x7ff84d08ab782⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1932,i,2153384869947754430,13047684287479308721,131072 /prefetch:22⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1932,i,2153384869947754430,13047684287479308721,131072 /prefetch:82⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1932,i,2153384869947754430,13047684287479308721,131072 /prefetch:82⤵PID:2676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1932,i,2153384869947754430,13047684287479308721,131072 /prefetch:12⤵PID:2852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1932,i,2153384869947754430,13047684287479308721,131072 /prefetch:12⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 --field-trial-handle=1932,i,2153384869947754430,13047684287479308721,131072 /prefetch:82⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1932,i,2153384869947754430,13047684287479308721,131072 /prefetch:82⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 --field-trial-handle=1932,i,2153384869947754430,13047684287479308721,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:732
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 d1b5daf6e810fbc02486434448cd5eb43902c79568c0482b79bdf9b060a3f4b4
- MD5 73458ed2ae463769e79063876fd7886c
- SHA1 e60c76ec601996990bf4548a484d89124986c1a7
- SHA512 513672a4576ade0d68de365f9bd66ae55ea7249d286b7d55db919a08701a4546d640d03e7a804048c8e45655c54109313df04bd8b8e5c0664173a820f8ccb49c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 a3782b20c187060724af9313547d5ff03e59b91fc62594d9d6eb962aac16b26f
- MD5 364002e4b6f18ac5715643a216ac770c
- SHA1 faaae88a8a103abe0a9bc47186771e54762f46f5
- SHA512 763d63eae91b2e600ab5f76f59508019fa181f4658b6aa1bae2e88de5f661cedc64ed13854fadf5708a37b88edf8181b0ecf557233099da4b8c1fdaee75135ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 0087256b62506f53c4af19a28aa839c24a2b15832269b267601917656a8e915a
- MD5 f915fc40d333f9e3c892d7cca09bf0a5
- SHA1 e3174a6d5b68083950d01c743914cf54b6126578
- SHA512 d300af74c0d4f5f8b5c4db20c9d1deeb27fec618016be9df909901a46042be666ade386173f79fbb998ebd15e896b5640e2a3e3c4c2f6e4b5af174252bdb3b85
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 d7302ec26c1a532e45b7535badf871f67bcec299f400402b41fa0f9c5872adf6
- MD5 9c370bd2dadd2f3b1eb36e0b9dfc6a2d
- SHA1 76b451241686df0ad4d21f91982dda9e4ae1ee71
- SHA512 a2c9f84f668c6eabff68d964a35395b0439451b286b9122bbcbd80c5da2c085ca6b08115f5f0fa27aef530c4e8451835c2b2f6d55438f3b8676555e884990d53
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 1aca0ff3aa1ee0ed9350e3e26bfd00125443b8de1855f10a8e696092b42fa893
- MD5 96a3587a154bc4c54ec446d95a9a26f7
- SHA1 a1eeb80f6e1ec61d5c37aa1179793bb3878be25b
- SHA512 a8f6982ffb0980b306f216d98fd49d6ff0221007cd381061bd0bb0e0e20c128e4f196dadbfd5725068f15fda7cdb624fd81ecea6d84f07027c7844dfd3a040b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 18d8ea9dd8a40198c8ff9bb5f03b5e20c95754b10ce96254f0b147ba4e5c898c
- MD5 e48c097c7d92d34bc546e615223b46bd
- SHA1 979db37c269e6e240eee3e08bbeeb8759a57f903
- SHA512 1d942b741bb9fae4ca7a1a42edf0f008e80277b5b612d62de3a84d4237ed4c98ae105f5bc82ab712129c06af37ba3dde623d520302062e69cc40d9b976998800
- SSDEEP 192:JvBrgNLsaJXK4g8syh+FrWZBP5tjEsXtScR:JvBsNBXKryqyZvtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 5adf37d90321509ff2c52ca4b5ab29ea5ed0c06e71b771139f8a622f4ee7049d
- MD5 4fec86ec4c725e040c93d865961503ec
- SHA1 b49db0f97c33b79562951f4e6a4a5a96bfb0f5ba
- SHA512 33c8fbaf4e7efbf4835510271fea40d0440777b4dfe9f4b181c11a1a986b80a23c7ef661b243240265ba47ca47a17f918a0d0ad8ad4c83a38bff998cb64d7ef6
- SSDEEP 3072:0Lwnz4F9teZuyz1nUI3S6v/UDr3dLDiuhcwaGqrksatpL:0vF9te35nfC5mgMatpL
- MD5 SHA1 SHA512 SSDEEP