Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2024 14:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://newwinner.life/?u=x9nw0k2&o=b8ep4qq&t=2s.burov.io_Dating&cid=caqrod128ge5s
Resource
win10v2004-20240508-en
General
-
Target
https://newwinner.life/?u=x9nw0k2&o=b8ep4qq&t=2s.burov.io_Dating&cid=caqrod128ge5s
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133621567852524948" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 2564 chrome.exe 2564 chrome.exe 4196 chrome.exe 4196 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 2564 chrome.exe 2564 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe Token: SeShutdownPrivilege 2564 chrome.exe Token: SeCreatePagefilePrivilege 2564 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe 2564 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2564 wrote to memory of 3608 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 3608 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 1624 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 4460 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 4460 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe PID 2564 wrote to memory of 2432 2564 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://newwinner.life/?u=x9nw0k2&o=b8ep4qq&t=2s.burov.io_Dating&cid=caqrod128ge5s1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e2ab58,0x7fff76e2ab68,0x7fff76e2ab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1892,i,1392635346229137812,7972181019714761180,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1892,i,1392635346229137812,7972181019714761180,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2176 --field-trial-handle=1892,i,1392635346229137812,7972181019714761180,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2180 --field-trial-handle=1892,i,1392635346229137812,7972181019714761180,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1892,i,1392635346229137812,7972181019714761180,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 --field-trial-handle=1892,i,1392635346229137812,7972181019714761180,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1892,i,1392635346229137812,7972181019714761180,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1892,i,1392635346229137812,7972181019714761180,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5afe138e-93db-4c91-aab0-f75a348cca5e.tmpFilesize
255KB
MD570a9d0001a1de94704260cdde48abc73
SHA117b2cf1032c0dc3bba17d015038e124741a2ba66
SHA256c6c325c8502f8c396c55523b0a30a30755424ffb58f3e3924c24c03329b5914d
SHA51215e0b496a3539bf89ae3da84ede92a045d79d2f073b3df7b504d5405ca478a243e2f440582e564b2657e7552a2197ed49cbf8b3ac2ac12fdc88eb5c96e3b08f4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD5e730589382ef6a952c4cd6536fd56674
SHA1f41c0df861242d1e42e1ade924a047c60e665729
SHA25643990728b25cd66f855afe02f23c728cc96a48ce2ff0dccb82c0ed118182dfb0
SHA512c86be2ad33055f0bb06211c71385609436e50f547a428549185909f3afa618ebf055c4fa8a2499525b929fa89452c4d4a31ec5bae3faffca1ec3c1b49f4297b7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD56642155ab18f3ba5a562fa48d01f503c
SHA1d9fa23fc31559dd6ff1d9bcf39cde4e1387ccaa5
SHA256941b31d113d96d4e894e0e00c91f99fab344d813dbbc7335b0285ae7d9d68cd0
SHA51212c039c5e3135507aad71c2eb1f2abe9ee920c75afab64062a738446c8033a10dca826496c979ec1dd8098eeb34aece79537827ae65b52f6284f1d17fa4a6351
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
691B
MD52772238c041435130c4a1f3c1b313d63
SHA1ff096d35aa48618783bd93640b3b3424eea37ff8
SHA2567cb44505fab4553218ccdd34ba5493623c41bbdc32cf62e0eddcfdf76d440196
SHA51231fef4d764a3a54304c90b8a34999a1d2570c6423cd319668cbdf82a34453bac59be6d12a066f076e2107983fa878e0d0a01542f9d40034d372558533d467637
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD536ef91ddfd15d9d53bba786610937037
SHA118e48f4c5c32ec48e0fd2f4e091d85cf4aeb4f29
SHA25601464975b23273dc5af63622276a93040c6efb9d12712494b7d2509acdc99b91
SHA512568ebc1a4a752af57145133d7e537f4422461a71abd5248d54d6fd5c0e7528ecdd9bbcb92f1f30ac9e89f5317a50520dafb3f8118b29dd3455abbd797afb9fe0
-
\??\pipe\crashpad_2564_ADMNVJXIZNECPOOHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e