Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2024 05:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://EssilorLuxottica.com
Resource
win10v2004-20240426-en
General
-
Target
http://EssilorLuxottica.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133622990253426928" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3156 chrome.exe 3156 chrome.exe 2184 chrome.exe 2184 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 2512 3156 chrome.exe 81 PID 3156 wrote to memory of 2512 3156 chrome.exe 81 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 536 3156 chrome.exe 83 PID 3156 wrote to memory of 4272 3156 chrome.exe 84 PID 3156 wrote to memory of 4272 3156 chrome.exe 84 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85 PID 3156 wrote to memory of 4928 3156 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://EssilorLuxottica.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9303cab58,0x7ff9303cab68,0x7ff9303cab782⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1828,i,7479238271864443216,14603325913439377692,131072 /prefetch:22⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1828,i,7479238271864443216,14603325913439377692,131072 /prefetch:82⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1828,i,7479238271864443216,14603325913439377692,131072 /prefetch:82⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1828,i,7479238271864443216,14603325913439377692,131072 /prefetch:12⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2920 --field-trial-handle=1828,i,7479238271864443216,14603325913439377692,131072 /prefetch:12⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4088 --field-trial-handle=1828,i,7479238271864443216,14603325913439377692,131072 /prefetch:12⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3112 --field-trial-handle=1828,i,7479238271864443216,14603325913439377692,131072 /prefetch:82⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1828,i,7479238271864443216,14603325913439377692,131072 /prefetch:82⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=1828,i,7479238271864443216,14603325913439377692,131072 /prefetch:82⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 --field-trial-handle=1828,i,7479238271864443216,14603325913439377692,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2184
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:216
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4e0 0x4ec1⤵PID:388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816B
MD5258dda93931320cc93207ff1f492646f
SHA1ff80900adaf864d74c2b2448e4d59746baa91d43
SHA256992946c1a7e32d7b4f9558897fabd2b25bcbfbab6c2ae8719f8852a15a6005fb
SHA512792629058b9c546c5abc67e683323aa2ac4ebf86076e28d3527f48dcd89f967e53f996134b4c7e86176ee4c0c4a8845071a52a39b3246bf91aebeeced7748ba1
-
Filesize
1KB
MD563fb08f220c12ab5bf7f101ed59d13db
SHA15624275f8f6ec60992c826e5a5c9652e58d1f67c
SHA2564a1fe7167ce88fd539bd152fc7121139f973b5adc8a15eba77590789096d227e
SHA5127197fd25299607cec6c6e4ad53a67f9baba749d338be21b29ca10691526e5ca2b735a49f516ef50750b8764648bce6a7bd86963ca23ad80f9c5942385ab54da2
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
857B
MD58ad6d72c4ffc5c501b0d0402497a4dd1
SHA13e0131fec98a1eea7e74ef1b3423588df5d96644
SHA2562524769d55cb468d32325500f82ff339684679851096e83cbf1ae5b2b14c7929
SHA5124f617c99f89c00e0dd7e38105cd502f56333e8a53d78f0e862583ef331dc9a50de560b665fb17ac464b800cdd5877c49b945e5487b31c5e3d1c9caab3ed90d1a
-
Filesize
857B
MD5b6653df3fd7c3df4b1400de27434546f
SHA1d71f56198b708554e4b87e54a871919a3e51ca64
SHA2562128bdbb4496cbaf64ae2f03362839b10c715ecf5c658275a7383b112b8ad6c1
SHA512f8ecce6e661a0d69e5f04e6df79ceadde62e86bbcb6ac3310b26917af812c560bb79651df44bd757531c3bd87d5de0cf0fd60c7105dd67de70b797b01b8ce567
-
Filesize
857B
MD5dab833f584b72ac8093d46adf59cac88
SHA1ccaf60e3bab38833dc5982fa92c269142b41572c
SHA2568ca4b25a9a1869b5ab5bd9617e62c3d279dc3be8d46ca7c4d2ea1c905e0a3315
SHA5123a988766ff8b7c6911defd517b24e6b976f288baea871f3b70c4175dc684b6c6a5bcec08e0b06e43291b20096c993952de0865f8295ba767ba53b2cba6333674
-
Filesize
7KB
MD5381a8a00b7d0c229b43dfdd345de0f01
SHA1a1647d4505c792ee81f56f72bb32d4e9f038d5b9
SHA2565e31942b33cc35f63b419ca505f4cee7cd298a6e41f5676987df9600c74d3619
SHA51218e22f8f89e403ac7bba81fb97206fba5a8ebec9d1ce162fa3c9fa2e39d87c05fd9a59fe93f4935cf4a2c35ae612dae2c76f96312b67f94950c24d4071963f49
-
Filesize
7KB
MD5160524b4ecf8e4ac0f26e95cd6e66fb2
SHA1d12d9e36679f235bd51fa40cbc5c73404686ff4e
SHA2561bcda6d5973f373a3e82633ecaaa46ba110cf49a49cdbd008489f993e1144e8b
SHA5125f4358e192fe64f2dddc7020d5569c2bb8d65a2dad5cfb895b88881933dd2b18eab87323b07b84c2fa08e3aaa91a9b3e8ca2a7867b42a0ecf91119ac623358d1
-
Filesize
7KB
MD52b23e723e5e79f423c3429657ce0c807
SHA1d89d595ecfc46b4b39faa9e16896261a33707446
SHA256a0c2b99ce8f40dca60ae639bbc8ccf41b000d6f6852b5b5b4544d90796307881
SHA512d3e5f23a9819c0587208a7e0f24458cc4e0eddeb4b31f72fd9cc5819b47ecdd92c04f3401aa05e2ba9dc29a0efb2be0f615302ff848cc256047d62f64ef3ddc0
-
Filesize
130KB
MD5cac59c85229afadccf39bcd456a9094d
SHA11538ef01b1efc4f9d0dfe2a8e34ecf928ab9c2f1
SHA25613b6825fda7ed3f340695b1019fc34e8815cbf48eb1c411b9f3bd386fb1e7e23
SHA5129c2dbfb429585585f73a64d2bf865bc04b76b2b48a5992eba092c33ed716a5c9f0fc5db88dba069bc7374da0f7949129e09ebe545a92f33ee08015670caa1b63