Analysis
- max time kernel
180s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 15:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://siliconvpr-dot-yamm-track.appspot.com/Redirect?ukey=1ExbVEWNlDxgrUtjysT32-Wl4u15VoSteROvSV-P9PPU-0&key=YAMMID-32228323&link=https://ctrk.klclick3.com/l/01HZEZWDJFTGXBMXTQ3X9SY2W7_0
Resource
win10v2004-20240611-en
8 signatures
150 seconds
General
- Target https://siliconvpr-dot-yamm-track.appspot.com/Redirect?ukey=1ExbVEWNlDxgrUtjysT32-Wl4u15VoSteROvSV-P9PPU-0&key=YAMMID-32228323&link=https://ctrk.klclick3.com/l/01HZEZWDJFTGXBMXTQ3X9SY2W7_0
- Sample240614-snwpjszdpp
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133628519211544492" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 936 chrome.exe 936 chrome.exe 2824 chrome.exe 2824 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe Token: SeShutdownPrivilege 936 chrome.exe Token: SeCreatePagefilePrivilege 936 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe 936 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 936 wrote to memory of 3692 936 chrome.exe 83 PID 936 wrote to memory of 3692 936 chrome.exe 83 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 4416 936 chrome.exe 84 PID 936 wrote to memory of 1308 936 chrome.exe 85 PID 936 wrote to memory of 1308 936 chrome.exe 85 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86 PID 936 wrote to memory of 772 936 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://siliconvpr-dot-yamm-track.appspot.com/Redirect?ukey=1ExbVEWNlDxgrUtjysT32-Wl4u15VoSteROvSV-P9PPU-0&key=YAMMID-32228323&link=https://ctrk.klclick3.com/l/01HZEZWDJFTGXBMXTQ3X9SY2W7_01⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4c19ab58,0x7ffc4c19ab68,0x7ffc4c19ab782⤵PID:3692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:22⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:82⤵PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:82⤵PID:772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:12⤵PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:12⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4196 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:12⤵PID:4220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:82⤵PID:904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:82⤵PID:2904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4624 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:12⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4760 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:12⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4908 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:12⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5228 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:12⤵PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4080 --field-trial-handle=1924,i,9869736980150798092,4408237323677910732,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2824
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 192B
- SHA256 175defad431b1719f58df565ae0158679ea7800e74a5c3379b4a3baab66c77ed
- MD5 04d42aae53e819fec0e370237edf0eb2
- SHA1 3c8490436ca04ad030231f08bd0c3162de470cec
- SHA512 7d713bfb359fc40a65d301bdad1fd68f8c3de9b24d0a37caa315361681ff41bdf2569a30e53f3b89852c0d273ce7967e3bb898b51161293248a52dd38639dde3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 7f9401ad6f8b209e1779d799acef73e2024aec926bb53d4f3758b6ea1153d637
- MD5 ac4b28f7b84a425441610f4936900c6f
- SHA1 98311008ea54d3f8c34598569a7332e1ce66e8fe
- SHA512 49b8c7286d61c6f225e16067a26a223a7566b37d9d36180f2a05acf7b660ea2199f1cf1016046b93be7133e0bb4ee0393784ce4720959164c9c1a5736ea87a5e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 aa0168d6d21d4000dc2f6fb8c5af5399a5cace27b9c35acfe2efd239d76d8321
- MD5 0e6832baf79d24fde8c74786b94fbe9f
- SHA1 23876b9c120eddb88b3a67c3e4d9be099abc6392
- SHA512 f71da4a86f365870c0ef71d0a83b15e51f30cdc7682d0a083a33b5ba30f0f8b2bc93e060ccd7eee04e4245291185e55eec0796ca7336fac424b3c80dee8eb938
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 a21ab76e64a24dedd2714a0c51ac2325646e7ae879222bee9fc7a71f105a6272
- MD5 577cce1b05a7f3e5e2ce7e6c298d6c48
- SHA1 18217136313650083711a1a20d94f29f468b71a5
- SHA512 b34da5c0ee3dad3d9982b777afa8b832eb9a4241b9e40f6512ce11989cac56f0d432f8177b57712f62a89fd260cc74a903540d2502cc87b446b5b234222c6564
- SSDEEP 192:VSHoc9OaJmpQm8Tyh+FAgiSO59P5tjEsXtScR:oHoc9qmyqziSiLtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 138KB
- SHA256 474de09113ba78fd8fa6076b03c8d19ee3f43dccd9c859f98e5e7bb92b270258
- MD5 8592f8231cdbcbdb91f9738b170649f2
- SHA1 2f7e8ca1a5a2a024a0cb91d0d99cfacf55b9b028
- SHA512 5067f17d3f16950c5bb0860e01de2dd759468fa8600f1980f1e423c319db1941708ed46ad6f186fe57cc558fb6532e5116102db24e38ee6da1b3c6f551501f6d
- SSDEEP 3072:5RcMw24LQfn5MY4R3q3m0qPaNjDpwU5mVXwE:IMw5Qf2RSTIadDpwU5CAE
- MD5 SHA1 SHA512 SSDEEP