Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 16:55
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
.html
Resource
win10v2004-20240508-en
General
-
Target
.html
-
Size
6KB
-
MD5
1e123a0a0f7bb89fc514d60259f681d2
-
SHA1
54f8c9724f591c11108834b9371ed23a1837cf99
-
SHA256
ead2648f0c356193d5440f4835cc638c8c37f563448d8c731b6291baa2fd08d2
-
SHA512
d61e63512ac826c89dcb3ccf4b351fa787108da3246133c78e528f87b68e03a2fbe9c66112c10b7ce89767d2c6d006a1f8b6ababd58dd2eae0b4aec52996b5d2
-
SSDEEP
96:C+9SKSlgcJcBar/FNQRGhz0vLmerLcaIN986e0wHmaAjlSWHFDyNKRydro0gkb8D:wlLIYUEYTgNCbxJ0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627716060222672" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3472 chrome.exe 3472 chrome.exe 872 chrome.exe 872 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 3472 chrome.exe 3472 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe Token: SeShutdownPrivilege 3472 chrome.exe Token: SeCreatePagefilePrivilege 3472 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe 3472 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3472 wrote to memory of 1496 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 1496 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 2460 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 680 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 680 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe PID 3472 wrote to memory of 4652 3472 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa808cab58,0x7ffa808cab68,0x7ffa808cab782⤵PID:1496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1908,i,8528646503475107422,4545445544205483070,131072 /prefetch:22⤵PID:2460
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1908,i,8528646503475107422,4545445544205483070,131072 /prefetch:82⤵PID:680
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1908,i,8528646503475107422,4545445544205483070,131072 /prefetch:82⤵PID:4652
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1908,i,8528646503475107422,4545445544205483070,131072 /prefetch:12⤵PID:1428
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1908,i,8528646503475107422,4545445544205483070,131072 /prefetch:12⤵PID:1204
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1908,i,8528646503475107422,4545445544205483070,131072 /prefetch:82⤵PID:4320
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1908,i,8528646503475107422,4545445544205483070,131072 /prefetch:82⤵PID:1608
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2452 --field-trial-handle=1908,i,8528646503475107422,4545445544205483070,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:872
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:5020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD55e5d6e1eb0edbc69c6f4c91d8288b555
SHA148c641f30c7a831fbdf1ce8ed3fca9d26c31f240
SHA2569e44b5e0d39cf8c8806dc2ae34532f9ffb19062fe524f9266b54dcb3fae431ea
SHA512dc4b194ff7867ede97950beba8c063b407a78114073e236ae3546b12c72ffa10d23e004a1cfe724a7f585beceaf0e798dd9c26a5a7a6a450f99db2a9e1127468
-
Filesize
129KB
MD59f62e49832eed7642da64a075a2bba54
SHA1467d56d17a2573fe65b799f7b8a7b02fdac1946c
SHA2569c761d0c76705e36af0c5dd832d64c34f04959ddd08685ee6217335a387504e7
SHA512210fc84d5382c3b4283fc510227b345228016cc01d4220f32f6aadbc8a68ab4485a5af8a0cf44c2d290a6efbd74bdfe54bae1370fa66d07172a5cbaf0c943aec
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e