Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 14:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://xxxarabsexporn.com
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://xxxarabsexporn.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133625046849326538" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 2984 chrome.exe 2984 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe Token: SeShutdownPrivilege 1400 chrome.exe Token: SeCreatePagefilePrivilege 1400 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1400 wrote to memory of 1304 1400 chrome.exe 82 PID 1400 wrote to memory of 1304 1400 chrome.exe 82 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4572 1400 chrome.exe 84 PID 1400 wrote to memory of 4040 1400 chrome.exe 85 PID 1400 wrote to memory of 4040 1400 chrome.exe 85 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86 PID 1400 wrote to memory of 3984 1400 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://xxxarabsexporn.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05d5ab58,0x7ffa05d5ab68,0x7ffa05d5ab782⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:22⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:82⤵PID:4040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:82⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:12⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:12⤵PID:4292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:82⤵PID:736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:82⤵PID:2044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4720 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:12⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4616 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:12⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:82⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:82⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:82⤵PID:4380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4408 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:12⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1616 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:12⤵PID:856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4104 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4676 --field-trial-handle=1948,i,7010440461523383867,18158703694229922089,131072 /prefetch:12⤵PID:4356
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5d2398723a1bdac42e9564707f1a28a24
SHA1a02c777a4b89c7e3bc6f05bf347cc9568256660a
SHA2567f3d89c817817a812293ae5105d907754a23225fed2b166097f004bff39a4ce6
SHA512cfacfeea779a78ff467fea74810e654c32ab1f12a551b0a7cc1581dad8a39df01aa4f90779f21266f4c51bee34f85d3909959ddb58a6793d81aa321ec2014906
-
Filesize
257KB
MD5a3f327aeef6ebb013f1ad278761a8b41
SHA1e1b825c2f0e66421e951c956b58ca725841bffa9
SHA256c2406187f5e8d3f778278a71258f298174b1fc8c1f9bc257d17991c3dce72012
SHA5121f7a5c971bd740f066d9495493e6bfcb5c9cab1dc7a0d1de4fa0a2340fd604785f6ae49278ebce36cb763ed631285b7371836b191118bf227a584b3c8fc95efc
-
Filesize
257KB
MD5f6d8664c455ca5a71ead9672b2b2a232
SHA1aa319d595aeb256730ebab960f3b5651fc9cb574
SHA256a82fbce766e01ad2dd0cd3f37d93414d7e0aca04bf63649f9385147fb5025505
SHA5123b15cb320bc22a74af2dc4a3d190cf1ba08e4fcdf97895ab006e76604c85f483fd4f9bb594207d3f033b04b31dcc10a468364e3fd45805811de3ed025c512f1e
-
Filesize
91KB
MD5d6868a1a35442148a12b8583dd6a4ed5
SHA1d4d31769c0aac0a319486889538ac52c5c9fb988
SHA256d28a2dbc7fcd3d8583097da4bccb08f7046ab7bbce72f4997fe470916801b700
SHA51298ced71ba11f90a9d4ba481b8dcc8f9020d5e20ace5e2a7576250940134ecb0e7c60ca0c1467fc19f489a4cb714db828c647b17f48cb47854cc34f7dbabccce2
-
Filesize
88KB
MD5b088e8ab43df79d71e143c461b1cd2bd
SHA1d3700efa5e35fcc9457c591d219c29eca900975a
SHA256b6b06c619dab7eca3ca565f8961abe1d891067c78e4e13feb283c20be53cc2ef
SHA512245d58975b851e8b45c875ff36ea65948d9cf30653974f075e5240b0affd288894e70d63e1ab3e15528ee876443c3e94acf04ec4a7c8e7b76108134e8a95b257