Analysis
-
max time kernel
1799s -
max time network
1690s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
09/06/2024, 11:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/RattlesHyper/TrafficerMC
Resource
win7-20240508-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://github.com/RattlesHyper/TrafficerMC
Resource
win10-20240404-en
windows10-1703-x64
9 signatures
1800 seconds
Behavioral task
behavioral3
Sample
https://github.com/RattlesHyper/TrafficerMC
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
1800 seconds
Behavioral task
behavioral4
Sample
https://github.com/RattlesHyper/TrafficerMC
Resource
win11-20240508-en
windows11-21h2-x64
9 signatures
1800 seconds
General
-
Target
https://github.com/RattlesHyper/TrafficerMC
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 30 camo.githubusercontent.com 20 camo.githubusercontent.com 27 camo.githubusercontent.com 28 camo.githubusercontent.com 29 camo.githubusercontent.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133624073269069769" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4532 chrome.exe 4532 chrome.exe 4636 chrome.exe 4636 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4532 chrome.exe 4532 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe Token: SeShutdownPrivilege 4532 chrome.exe Token: SeCreatePagefilePrivilege 4532 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe 4532 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 164 4532 chrome.exe 72 PID 4532 wrote to memory of 164 4532 chrome.exe 72 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 2472 4532 chrome.exe 74 PID 4532 wrote to memory of 3648 4532 chrome.exe 75 PID 4532 wrote to memory of 3648 4532 chrome.exe 75 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76 PID 4532 wrote to memory of 3128 4532 chrome.exe 76
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/RattlesHyper/TrafficerMC1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8d2959758,0x7ff8d2959768,0x7ff8d29597782⤵PID:164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1820,i,10022831229660805101,11385742607901790646,131072 /prefetch:22⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1820,i,10022831229660805101,11385742607901790646,131072 /prefetch:82⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1820,i,10022831229660805101,11385742607901790646,131072 /prefetch:82⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1820,i,10022831229660805101,11385742607901790646,131072 /prefetch:12⤵PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1820,i,10022831229660805101,11385742607901790646,131072 /prefetch:12⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1820,i,10022831229660805101,11385742607901790646,131072 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3736 --field-trial-handle=1820,i,10022831229660805101,11385742607901790646,131072 /prefetch:82⤵PID:456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1820,i,10022831229660805101,11385742607901790646,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4636
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3d64accb-2c9c-4f7a-a790-61093ec2d59d.tmp
Filesize6KB
MD555002f231c9261ff3a8682df3e39fc0e
SHA1e983cb18fd2a0c39006e0f265a203b4ee3d679a2
SHA2562b30f93ff268ea37188978ab95382cc56873a61ae465ab8f8d00186393cf5f47
SHA5122b3462964eda9dc4e1d1cb702108aeb52c2ccefd245f8ba31c6ff316a933ee7f5b9fe2b6e6940f31525fac1d0aeed6ad7c5541ba3b10aabbfb96c5c3ebebca3d
-
Filesize
1KB
MD5b6ecafe1d63e6af10b258241c9cef868
SHA16244a4a6ad53b7d6a8f14853414dc1c0b31ecc7b
SHA25656643a3d03fc263239904db8b99d3e8ae00183f07d2976915610b1722cc7a8c0
SHA512a29690acee539550e37f8e3bb5144739a2a9fbb1ef3f43147769af79dbd9369c2b14fec6de3374c81ad35297944b70f64928c3e24687c72cff237547e01d1591
-
Filesize
1KB
MD5979dc892945f5b9ba92cbd416cb17121
SHA14f33bffc88633e78dd3f17fb0c22966879304603
SHA2568e128cb9735dd6ca07d37b332be90852c41f42e5f448ed1088f247da3d2857b4
SHA512e29b9c44d734359b353e5524585f051971082ebaeefe6442246d6aef03215b647ff5639fb7a67f4e4dce81084f979e3fa1c05570914853e5ab8077722167aebd
-
Filesize
1KB
MD592cae300caad205171e6f88dfc0de5d7
SHA189a6eec2cb10a7edb826a342454e9dd54e61bbad
SHA25622d18fcc36fafcd10027eea12e6a1213c575e4ef8abc997dac0d0a2c85efbeaa
SHA512933ababd4fe7c055d597d1493e6c69379014f3d2ed1653d92295cbe7a65f1733532b96a58126febeeff48b363d477ffebec384fdd3e80e483498adcfe3a07d35
-
Filesize
6KB
MD51aa73621a59d25fd27cc119c0852dbc8
SHA133cb31b3ee06d1da7d88a4a385fb59256558be33
SHA256e39d969172ab2ed39be6a3f5fddb36ba5901f0da4c12e09f1a1f6c74ee58e573
SHA5123b8a42abf812e3e5b4b5e776d8afa77fa49935fd2df81d63205a5148e3348fe93a7f065b8241217141a723888df16edc5e8a612cdb5a093b3151530af61500d2
-
Filesize
6KB
MD53f0a8155a42ee65987a6aafbb34bec1d
SHA166e6cd2a77e8229183470690cb32fc6ad30c7ff4
SHA2564afba20aea99a144dbfaec8c4eecd837a635adf1dfce993251661e36616d598a
SHA51236f2fb16dfcd6065f10a4d8ac4f343dcc4c403763b1f63a6c8ef28f8be511a627148e8d8a3d82eb8acf3ec2814dd776ee2cdd971e1e7299b18ea45d32c6c4b4b
-
Filesize
136KB
MD5c4974a662e560a72dc3e358b696eb8bc
SHA1d6fb0b7bced01f56c768efbd933e88b13473c86c
SHA2561818ec0907bd9e53efab44f71c859d4007e7fb9921416f0dbd56ea52fd219221
SHA512d424cdc068c05712d53b9f6e44cabd332c5d33b095f8632e0e656108e0cac61c3d8efc327c454a4d9b7bec45451c11ea977ff50bc5fa85ff9c0d40a3d6b77b81
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd