Analysis
- max time kernel
56s - max time network
51s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
07/06/2024, 15:00
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pub-afbc35322d874efbade95d3afb25b97c.r2.dev/webmail-index.html#[email protected]
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
General
- Target https://pub-afbc35322d874efbade95d3afb25b97c.r2.dev/webmail-index.html#[email protected]
- Sample240607-sdr9dabb34
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133622460948076568" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4768 chrome.exe 4768 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4768 chrome.exe 4768 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 60 4768 chrome.exe 74 PID 4768 wrote to memory of 60 4768 chrome.exe 74 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 4576 4768 chrome.exe 76 PID 4768 wrote to memory of 992 4768 chrome.exe 77 PID 4768 wrote to memory of 992 4768 chrome.exe 77 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78 PID 4768 wrote to memory of 3536 4768 chrome.exe 78
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pub-afbc35322d874efbade95d3afb25b97c.r2.dev/webmail-index.html#[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc54719758,0x7ffc54719768,0x7ffc547197782⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1772,i,5405348587838565816,8948647225394695573,131072 /prefetch:22⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1772,i,5405348587838565816,8948647225394695573,131072 /prefetch:82⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1772,i,5405348587838565816,8948647225394695573,131072 /prefetch:82⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1772,i,5405348587838565816,8948647225394695573,131072 /prefetch:12⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1772,i,5405348587838565816,8948647225394695573,131072 /prefetch:12⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1772,i,5405348587838565816,8948647225394695573,131072 /prefetch:82⤵PID:4104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1772,i,5405348587838565816,8948647225394695573,131072 /prefetch:82⤵PID:664
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 656a44fcc5ff694bf9af37beb3f9387893bef3c9bcf45f44c80641ef08dc6d7a
- MD5 57f42060c1781b2101f7735c612ca0ae
- SHA1 01bae10c1dfe21b151ffa885dee9d40f4f27599b
- SHA512 2b8e7939664bce5177a63017142d4e9342890cd54f47955f9e2f6e6bbe8aebda532a7286d6fc92d6a3efbb7f2e26490cc916d398e24652ba0305153c7a1cb4ac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 872B
- SHA256 0ce9757578a73ac50dca1b50228120ba2bfa21be70ed92cc43141f5982d92333
- MD5 956b2d6fdec419a89fdec86828f5d99b
- SHA1 16a4082deb9dcba494f872d75b874a1fa11c5726
- SHA512 d85dcb9f2d0f5c2daf97fde03aac0e765bf7781d7ed6b8d561a36b1b45c090360314ce3e0d8cb2b28e17965dc250616cceb35261be5773c86cdb28ab80fd066c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 f126158b2e6af48c74315af4e0ba3aacba26605dfe68435840434fad2f57bc45
- MD5 8fc7210807f3fc88b3d5aaffd4eea4b6
- SHA1 60673e0f9d9ec243a2150a447df760c21e6b7982
- SHA512 aaa407643a18215c8c880a02f5466b682e1de0571b20703cf061d4223636da23f74bd7234eeead38a7033ec8a640868f78b4b919f9d005f74e5b064dbadfa9ca
- SSDEEP 96:pxYfKIiA8iZRy7Di+6Msmdeok21ssO2CB0tajVhYtjEsXt0/cg2Vup:pOfr8syy+FZk2mc4otjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 876edd29a4a5307faccb20942fa8ae5706b5d0b7e7c42479738900338eeea2b5
- MD5 3acbc8209ac1931390ab4d5f9eea19d6
- SHA1 e65fc483e4174522e41fa16969bebafa0426e036
- SHA512 60e5e0668198836673e7b000ca09913f745825236dd13d73296b0ac52b2cc36f568a647fbab8cb69234653478087a3213435633224d5bc637288962d69729237
- SSDEEP 96:pxYfKIiA8iZRy7Di+6Msmdeok21YIO2CB0tajVhYtjEsXt0/cg2Vup:pOfr8syy+FZk2d4otjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 136KB
- SHA256 90d32bfa07429f46175e3f25ba08f22d6844b170bbc6c80730c85a33fd7e6bca
- MD5 a79481be0973648bd2e3ac12f10c337f
- SHA1 810320f0e32f35686d623ca561b94f858047e8d4
- SHA512 dec3a2b033c762f044dfd5f40c00b3f9a3f31a0a8a90699168b30155dfa136f2b99667e90e61335ae30ca67172b6b1c4d92af9c12dd7372a55c5147ef882ddff
- SSDEEP 3072:1JWBjHQ1gH0C1nkGXmeWSyXHklNcGiiRn2a8EsI:nW1HJ52My3klNli6nln
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512