Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 15:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.google.cv/url?url=rfjlxypd&izc=kdIP3mG&llw=vG2yjFf&vzijgb=EU8IAWA7P&wqqrz=pA3yHm&ytzj=D8UGDXCi&zoi=p3WJzKx&dwo=tNkxGfQ&lwxkfa=sVyoevd4d&gmctp=dHgmPy&daux=wqqQA7cA&q=https://www.google.cv/amp/qwdbkav.googleapi24.casacam.net/swyx4xcc&uvn=qNN2Fz3&yhh=x5c42F7&nhidap=92Qm61Og7&cyquh=lwtJPK&nbxr=bxqx6fW7&uuq=19JEebo&owu=7yVFfqp&hcoump=d74tNlRnc&jqtud=aAJQ7z&gxda=qz5LjItu
Resource
win10v2004-20240508-en
General
-
Target
https://www.google.cv/url?url=rfjlxypd&izc=kdIP3mG&llw=vG2yjFf&vzijgb=EU8IAWA7P&wqqrz=pA3yHm&ytzj=D8UGDXCi&zoi=p3WJzKx&dwo=tNkxGfQ&lwxkfa=sVyoevd4d&gmctp=dHgmPy&daux=wqqQA7cA&q=https://www.google.cv/amp/qwdbkav.googleapi24.casacam.net/swyx4xcc&uvn=qNN2Fz3&yhh=x5c42F7&nhidap=92Qm61Og7&cyquh=lwtJPK&nbxr=bxqx6fW7&uuq=19JEebo&owu=7yVFfqp&hcoump=d74tNlRnc&jqtud=aAJQ7z&gxda=qz5LjItu
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133626799418912804" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1208 chrome.exe 1208 chrome.exe 5048 chrome.exe 5048 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe Token: SeShutdownPrivilege 1208 chrome.exe Token: SeCreatePagefilePrivilege 1208 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe 1208 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1208 wrote to memory of 4200 1208 chrome.exe 83 PID 1208 wrote to memory of 4200 1208 chrome.exe 83 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2604 1208 chrome.exe 86 PID 1208 wrote to memory of 2616 1208 chrome.exe 87 PID 1208 wrote to memory of 2616 1208 chrome.exe 87 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88 PID 1208 wrote to memory of 3020 1208 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.cv/url?url=rfjlxypd&izc=kdIP3mG&llw=vG2yjFf&vzijgb=EU8IAWA7P&wqqrz=pA3yHm&ytzj=D8UGDXCi&zoi=p3WJzKx&dwo=tNkxGfQ&lwxkfa=sVyoevd4d&gmctp=dHgmPy&daux=wqqQA7cA&q=https://www.google.cv/amp/qwdbkav.googleapi24.casacam.net/swyx4xcc&uvn=qNN2Fz3&yhh=x5c42F7&nhidap=92Qm61Og7&cyquh=lwtJPK&nbxr=bxqx6fW7&uuq=19JEebo&owu=7yVFfqp&hcoump=d74tNlRnc&jqtud=aAJQ7z&gxda=qz5LjItu1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2928ab58,0x7ffa2928ab68,0x7ffa2928ab782⤵PID:4200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:22⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:82⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:82⤵PID:3020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:12⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:12⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:82⤵PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:82⤵PID:3676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4348 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:12⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4512 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:12⤵PID:3660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4724 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:12⤵PID:1320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2644 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:12⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3256 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2940 --field-trial-handle=1896,i,18283461906978879386,9150448547751398728,131072 /prefetch:12⤵PID:2672
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD55d00d95aec51ee8ff7b03dfb0d1ea6b5
SHA1c0c6d5a11d5b210ce10f258062bf094294c93699
SHA256896edc22de4cf44f20a1467e677c2ae7b325f8ff8032bd7392cc4191b7bad46e
SHA5124aed943fe0b9394be5a7e6949e7661bd840507305dfe2b4430be1ecd671dc6a38488d3ec2d152be13c32f43e2f6f2b4735aa1769a6e426e10f6bdc080e751102
-
Filesize
7KB
MD5818da0d647f941e3e6625b5db382aad8
SHA1610f48f9737a8652ef13ffc1dfeeab6a51a4fdc7
SHA2566e3641b044d73f3d072bfd69a754ddffaa574854567acaa6e61a22d00229633e
SHA5128cad49774774b8e827234dcbf6553f8262491b037cbc0029d9e32dc088f44fd9823342a7f31e2ad910f11a3efc9979d16173fed95fa3cf1e4e1ce9455b8ebcd8
-
Filesize
129KB
MD5068dd8312726271cc4d76c155764a566
SHA1b349003b2bf8f17c1af98faef8c94db55cf29b4b
SHA256e65fb5a0476c71fdbf4c18f4be7a27dabaf62ee0bf5bd91fd0e26092928207a1
SHA512316ae4cb7004aee1e74777b7fad3653e7b315e3b57d13090efe628de98f82f88f3a5e70092f9039f400cd125728a9f362b0f87d982da20e68500d33264f8ae9b