Analysis
- max time kernel
30s - max time network
31s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
General
- Target sample.html
- Size 20KB
- Sample240612-tbe2psvbkl
- SHA256 d19378b66be2e95ec3d86928ca4844a65358c57a8dc5fa6fc3a8cab405a53e71
- MD5 cb5bff926e082851671dd51800534d9c
- SHA1 52dcdea36097f0b049038513441def4133a2da94
- SHA512 b0f701689ba3e7a04a25aa105cc9fb2eb42ddd604438a2d3c782ace6ed6eba22a99ee9846338307e4e4476f581b4f004eda9082354312fc0574bb70d0498e88c
- SSDEEP 384:rZDug59spY1ocy4Rd4lbGayVU8Hhhb7MvH+nomXIyjasK2fa2hOwV0b0E+ug8xCh:rZ15Z1ocy4ROEay5Bhb76HaDnjaZ2hOe
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133626811862978883" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2300 chrome.exe 2300 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe Token: SeShutdownPrivilege 2300 chrome.exe Token: SeCreatePagefilePrivilege 2300 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe 2300 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 4616 2300 chrome.exe 81 PID 2300 wrote to memory of 4616 2300 chrome.exe 81 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 804 2300 chrome.exe 82 PID 2300 wrote to memory of 1512 2300 chrome.exe 83 PID 2300 wrote to memory of 1512 2300 chrome.exe 83 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84 PID 2300 wrote to memory of 4604 2300 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7cab58,0x7ffd6b7cab68,0x7ffd6b7cab782⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:22⤵PID:804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:82⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:82⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:12⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:12⤵PID:1360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:82⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:82⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4056 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:12⤵PID:436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3308 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:12⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4216 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:12⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3164 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:12⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4544 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:12⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3228 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:82⤵PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:82⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3916 --field-trial-handle=1824,i,8324137564934336997,17670821265886302151,131072 /prefetch:82⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 424f1dfc2e975db0e04bc7e607c2ca8985562aff2cef87b37eb6ca5c8f8d070f
- MD5 79c0fa11e7ed8ccb0611d6bd85c123ff
- SHA1 13646e6d95e8df475a41773d01fdb5c87e158078
- SHA512 a1fe48a7719745024a483be9d179bfbc75fb8c4032e2b2287f5c44244fedcb82ea598a477b9f488b9da0e189e96419efaa9f071ef94c8a9e6baf0104797873f7
- SSDEEP 96:q0VjmpXNwjAE8KIkJZb8iZRy7Dx+6MSmueyIOHtJj2MEVhYtjEsXt0/cgVup:qUCpOjAE8aJZ8syh+FCdjP5tjEsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 176f0578ddbedbd146b29e39783f82c63103c0cc2a42930850c26552944b22b6
- MD5 da3a6e60eac916b05670d606ae56ce9d
- SHA1 fb6c02c81baed822d44a0d9a1bd9df00c827704c
- SHA512 fcef50cb8e613051bc0d4c8c4f61ea8d2caa56935abcc0238d116b87fde6dd1a0b317bb5ed4bca4754c57e911a96252648879ee394d9f2fd0340b53169cf0b65
- SSDEEP 6144:u2rI1Qo5yzkpeXjnJFzXsWJQYRPILxZnhLMJjX0EeGzY2rL+:rEjCkpeXtFb9Q5fnReEFsLL+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 983e8ae01fb55d9d2004ad1f324fe75a314a5f3c6e924b6697ab97060fcddb5e
- MD5 9cc389d064e8450f27f6f3f178096b6b
- SHA1 234820283a18acb4afc06f3ab141c3f5f68e7049
- SHA512 511f60fbfd001ee716471e154d6462d625020dcf030386d67a2eaef043c3e8126a3db56f419d9c91a444a1b1b52e6ad96c2c45ce7113e25c12fe3b35858ba09a
- SSDEEP 6144:uCrI1Qo5yzkpeXjnJFzXsWJQYRPILxZnhLMJjX0EeGzY2rL+:1EjCkpeXtFb9Q5fnReEFsLL+
- MD5 SHA1 SHA512 SSDEEP