Analysis
-
max time kernel
299s -
max time network
256s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
06/06/2024, 05:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://c.rydal-telecomsmail.co.uk/W-37-4c9-38qeh-ihq5i-76addn93g
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
300 seconds
General
-
Target
https://c.rydal-telecomsmail.co.uk/W-37-4c9-38qeh-ihq5i-76addn93g
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133621249048570171" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 4960 chrome.exe 4960 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3604 wrote to memory of 1568 3604 chrome.exe 73 PID 3604 wrote to memory of 1568 3604 chrome.exe 73 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3436 3604 chrome.exe 75 PID 3604 wrote to memory of 3796 3604 chrome.exe 76 PID 3604 wrote to memory of 3796 3604 chrome.exe 76 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77 PID 3604 wrote to memory of 5020 3604 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://c.rydal-telecomsmail.co.uk/W-37-4c9-38qeh-ihq5i-76addn93g1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb78069758,0x7ffb78069768,0x7ffb780697782⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1784,i,6061786229982043330,6091101568249234781,131072 /prefetch:22⤵PID:3436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=1784,i,6061786229982043330,6091101568249234781,131072 /prefetch:82⤵PID:3796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 --field-trial-handle=1784,i,6061786229982043330,6091101568249234781,131072 /prefetch:82⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2856 --field-trial-handle=1784,i,6061786229982043330,6091101568249234781,131072 /prefetch:12⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2864 --field-trial-handle=1784,i,6061786229982043330,6091101568249234781,131072 /prefetch:12⤵PID:64
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4448 --field-trial-handle=1784,i,6061786229982043330,6091101568249234781,131072 /prefetch:12⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1784,i,6061786229982043330,6091101568249234781,131072 /prefetch:82⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1784,i,6061786229982043330,6091101568249234781,131072 /prefetch:82⤵PID:4036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3176 --field-trial-handle=1784,i,6061786229982043330,6091101568249234781,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD57aa985e78148fe09569705c355605808
SHA138692bec754f82a0d2e120cf464a18887b11164c
SHA256d03b7004a6ca722edeb10c91fa9ecb36965649179dbf0050c3b57a8e9f88f0c3
SHA512e4e69df519e2e68959de67dc3bdbc8c876a65f6225a47b427491a048e0287e0e312fbe79b796b240b5ee53516250cccdd83e53cfdc09df63f59fe46d91cabae7
-
Filesize
5KB
MD525648a3e4724dd1bb5aebd262c501eb0
SHA1570148c9c041b8434f5c739cab251bccda7da9e6
SHA256f8fb43e3edf0ced7e6f59f03488597d723b519fa34454a8f0edcfecde16424e3
SHA512210020845ba3e84263bdb817e23e4a05ad4ee7b7d5d144fe2192c6e16993d1c7d2f47e4af994299de1d12d68ebef2657c8ab884be019c9a10f061388e24c3dab
-
Filesize
5KB
MD5632b48f0dd09089ccc9d3b64cfd290e1
SHA16f207ce69a1d223aeb29b624d79b8e0574df664f
SHA2561584ba5c6d97c9fb8a0c5b1ec838bf8fc234de015507d4eb71af52b29ca411c8
SHA512356dd9cfbe04803ecb20f00d0f66c0e5348bc8d3a2fc2c555106db0cb79c0f78aa9e0500328dd9f6d60aad34a22a68470d87903aa925f09c2d3b183b44c79f90
-
Filesize
136KB
MD55eef1da4e3aaca48cfe5e87abd16783f
SHA1ccde4774c613b5473630cff1839a193c7a58f193
SHA256af1d088161f92813866e6d80ab246adc63e072e36bd17f10d43212447c266456
SHA5123754e9d9924f76ec3a7372d89a9da00a46499893b711e21b3fabd5277c9fd8f2d62ab369d27bf6158832bae51b70b65688726364c38f76412011bd2707bd4b85
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd