Analysis
-
max time kernel
299s -
max time network
294s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 01:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://acctfundmsg.info/
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
https://acctfundmsg.info/
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral3
Sample
https://acctfundmsg.info/
Resource
android-x64-20240603-en
General
-
Target
https://acctfundmsg.info/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619369608365811" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3644 chrome.exe 3644 chrome.exe 1728 chrome.exe 1728 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 3644 chrome.exe 3644 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe Token: SeShutdownPrivilege 3644 chrome.exe Token: SeCreatePagefilePrivilege 3644 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe 3644 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3644 wrote to memory of 224 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 224 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1244 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1084 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 1084 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe PID 3644 wrote to memory of 4372 3644 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://acctfundmsg.info/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d94ab58,0x7ff97d94ab68,0x7ff97d94ab782⤵PID:224
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1928,i,1945589855753280971,15837433278706050865,131072 /prefetch:22⤵PID:1244
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1928,i,1945589855753280971,15837433278706050865,131072 /prefetch:82⤵PID:1084
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1928,i,1945589855753280971,15837433278706050865,131072 /prefetch:82⤵PID:4372
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1928,i,1945589855753280971,15837433278706050865,131072 /prefetch:12⤵PID:3148
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1928,i,1945589855753280971,15837433278706050865,131072 /prefetch:12⤵PID:2116
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4472 --field-trial-handle=1928,i,1945589855753280971,15837433278706050865,131072 /prefetch:82⤵PID:1180
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1928,i,1945589855753280971,15837433278706050865,131072 /prefetch:82⤵PID:1172
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1928,i,1945589855753280971,15837433278706050865,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD545a9e4a558f4b506902467b355108cdd
SHA18e0b9874fc60b66f281aa3ecff16bde07fd65b40
SHA256604aec510f24ff986267c4b5fba20d54292680be853199b794cd34bd6917ef80
SHA5128a897ceefd94f1e1609a18456e44c759888e703c3719509436b3d3a44cdf7c93a98f8ed210f076b26a36a7ecb62dfbfe1f130a0f28df07e837e3b0184dc9a31a
-
Filesize
2KB
MD54efab470765c219299ab0d0aebe24f19
SHA12eeee2318265337d2e56e17dc38bcc77d5dd9900
SHA2569bd3056cb3954fcb465c53d5545f223365c0ccec38b878d2835e45dcb641c697
SHA5125dbee6ed45f37c2765c28fda974fcdc7f5f8e60a1f980d4854bf21a8b5d3c89984d1ca2ee87d111df0d0e6dcff28d6d97fd0aebc6b55ff90b6c91f5b26ee27b4
-
Filesize
2KB
MD58797153a25a90b8f5e1246f9099456c8
SHA1abca588548cd9e6a6ca31aaab45a8ad066d4cc74
SHA25640baf540d93a42482688df7f04dca8b83a1a80bf0f2bed2749f96feb198184dd
SHA512470b9e18345eefc8f372e7e396333cf0b52c4fc737f1b99896ad68a54ecb7e656a979025ba3f095bd6e7ac4a6f184dfc12ef50af0f8d7ebd554365418f52cc29
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5fc7d810b0067225b85a877ffb69c45cf
SHA168e8eaf2e3506b35a08517243991d0d0e2911e92
SHA256bd329a3a97a5ab89ef70c938afef37fc897eba9f1d563876213018885577c4d9
SHA51222ecefe5671b3f377690748398f48e803ae9b48bd9caade927550a99777a65ee6fb6700b3ebf1f2ca671223c08ed03f0b27b36fb670258e66c4a63211faea193
-
Filesize
255KB
MD5793037af4d6fe9755cc21deb1b07692e
SHA11ff543e3ab31f2b390152aa8f47a04ea73551da1
SHA256b1dce0cbc964a41baced016b87ec7ef15aec2d8d2012af5fcb79b60b0220d7be
SHA5123d649fc0cd3cc6f5b352ad3e0c210d842594ba0e2a402be8b0d9313d55fbdb80247fa435a3f9be246f8e88546ae406223d043ce2060510b6300517267fe4e9a8
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e