Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 17:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.dlapiper.com/
Resource
win10v2004-20240611-en
General
-
Target
http://www.dlapiper.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627747881592376" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4052 chrome.exe 4052 chrome.exe 1780 chrome.exe 1780 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4052 wrote to memory of 2408 4052 chrome.exe 85 PID 4052 wrote to memory of 2408 4052 chrome.exe 85 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 1468 4052 chrome.exe 88 PID 4052 wrote to memory of 4472 4052 chrome.exe 89 PID 4052 wrote to memory of 4472 4052 chrome.exe 89 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90 PID 4052 wrote to memory of 1960 4052 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.dlapiper.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6974ab58,0x7ffe6974ab68,0x7ffe6974ab782⤵PID:2408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1880,i,2333441525709897348,6214891411275667008,131072 /prefetch:22⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1860 --field-trial-handle=1880,i,2333441525709897348,6214891411275667008,131072 /prefetch:82⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=1880,i,2333441525709897348,6214891411275667008,131072 /prefetch:82⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1880,i,2333441525709897348,6214891411275667008,131072 /prefetch:12⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1880,i,2333441525709897348,6214891411275667008,131072 /prefetch:12⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4188 --field-trial-handle=1880,i,2333441525709897348,6214891411275667008,131072 /prefetch:12⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4232 --field-trial-handle=1880,i,2333441525709897348,6214891411275667008,131072 /prefetch:82⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1880,i,2333441525709897348,6214891411275667008,131072 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 --field-trial-handle=1880,i,2333441525709897348,6214891411275667008,131072 /prefetch:82⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1880,i,2333441525709897348,6214891411275667008,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1008B
MD51388c3a933163c41497e25c031c89430
SHA1deb8c9ca4d9c93e49376e55611820a7621a3f0de
SHA25630fd91913f546365368880c74bd8ede759d5fbc1819682f406544b26b019c2fe
SHA512f48cf980fe9339b76e7fe2d06b3e5ce56ad8b3420bb068b85a172ada346bb8842b733b04d27547e9eb4faae4f021b64f5eef65d49a9666954926343c82fe83ee
-
Filesize
2KB
MD5ac5a69a2765bf6e7e9d133e3616a39e7
SHA1405053e2087b649505b04b01786e0ad083151e18
SHA256ce1384d4e61af906186c194e339844346fb613ac8953191985b7fedf3c4b457d
SHA512aa3463a7a7a0f839357e8d9ee2ef29127b6904160d0c76e9f15cbf51cc19b0a2d4759f8c3ee7c266bc6eca18d5595548a35cffea561a8c186d4d54413b98e217
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
857B
MD504fbe46b6f7b7eaa4a49238b24f6bdc7
SHA12d548e01eada6e4e65e5cd5eaaf19759efc2e7ca
SHA25620c486cb173255f86535907f34923feda7159f966ac5836d2fd27fb8d1710790
SHA512e29ac88cd38d03db6840b76d94ce2ee169e1c85683b6b4affbb80aa18f6a457cab0255050288a58041158c030f29edb07212054cb51f7ebd058d5fdfca1de422
-
Filesize
7KB
MD5c4498d10b79c9a3ee3f34147f419c0b9
SHA104a1de3d735ef231553e9dd201ed1fb89e72384b
SHA256f5f3469846230b5ab1b36876eb3904a543c4e4eab1f468988861ceece5d0d66a
SHA51212cde493fb5e08b6713ddbe9e56100286a9dd269001bde96a1c8e6db874ff9196584922a9eac92b83a63fc83df18c6c65a172e3cd976afbfa6e715a7b9a44471
-
Filesize
7KB
MD5c0e52d63eecf0efca5536bac0bb4c234
SHA119f7a799b2e1d6d22694da5d7ced7579d9d3b48f
SHA256cb38bc93872512efac4f5a19e7f2c1f5b70383e28e9fafee7f64110d914ac8c0
SHA512834c1c7c9d0dc3cb9b2b4ca8e721bfc36d94bbf0c0fdb1aa54954d5d533fe807aa9697bb7a82475e90eee43ba5b071a0e92f9faa531287e871d294b610ec3274
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD50b8f944c0ce978dcd8c308c2f53930d6
SHA1f01fc8c2598f91fc268f17a668d5528e545cebe0
SHA2568566e1888782029f6c52c284c573a836084156fc72d16f91952e13c5907d059d
SHA5121d0dc679bd9c50374033e8ecad689193ad081050db24b34b52dc3188a0a8054e37f7a974a2d9463685278f8d6b7fa2a6514bac68a79c3e314fb59bfa3902fe53
-
Filesize
138KB
MD5ae5ce56d5915f7619cb4a913871c8746
SHA1419ccca6599400f3250c9f23a459ccba77db8927
SHA256e0ab6e8be94ee4b3d2b821ea286ddb07f3ec7dc7f9525e0982aa1f4db041a700
SHA51235a7d92f602f3cb38a071ad047d62704eeadde65da7f83d96dc46948fd3aae48a544c01587eda5a8cca0ff9fa54314ac20802c0568dad7b73466062d19284208
-
Filesize
89KB
MD52bf098dddc03117b520494b7e45bc16a
SHA1e346da5cb505094d429b42fdb16579b863c515d7
SHA25644537594b553a3d963768a6f2d0cee3c8bf01351a6710ff4cdc50f52723e72d3
SHA512b003701b5aae7d1103a292508fec6049af203024cb529a275523923be86edc92ce7bd2d9fe66eca681898ba7a87cce8d3edcd98e91c17f3b6a9841d8872fcd0f
-
Filesize
88KB
MD5c3050d382f5fef90a509d8125b1a4392
SHA1a99f5f888c8cc2ec756a70b5f75fb61b0d79b165
SHA256b0c5cf0e289c3cdcb4f630e8620e50cf424ec6a0e8bbd832cecd8d3431ce1d03
SHA512ad17d86ee3d8446db6118cc909bcb93a378536420b46a6551d8eb2411d0cc46969602bb474601626541f9f6ab7562708164f84fbc12196ad57a13328c68f60da