Resubmissions
15-06-2024 00:12
240615-ahgpbssbnh 115-06-2024 00:10
240615-agjgjawbkn 415-06-2024 00:08
240615-afdvnawaqp 115-06-2024 00:04
240615-acz9gs1hqh 6Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 00:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Google.com
Resource
win10v2004-20240611-en
General
-
Target
http://Google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133628866910518264" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1048 chrome.exe 1048 chrome.exe 1056 chrome.exe 1056 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe Token: SeShutdownPrivilege 1048 chrome.exe Token: SeCreatePagefilePrivilege 1048 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe 1048 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1048 wrote to memory of 3040 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 3040 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1824 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1544 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 1544 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe PID 1048 wrote to memory of 2236 1048 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Google.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81a32ab58,0x7ff81a32ab68,0x7ff81a32ab782⤵PID:3040
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1872,i,16240333826000272274,3721426586565119233,131072 /prefetch:22⤵PID:1824
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1872,i,16240333826000272274,3721426586565119233,131072 /prefetch:82⤵PID:1544
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2068 --field-trial-handle=1872,i,16240333826000272274,3721426586565119233,131072 /prefetch:82⤵PID:2236
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1872,i,16240333826000272274,3721426586565119233,131072 /prefetch:12⤵PID:4808
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1872,i,16240333826000272274,3721426586565119233,131072 /prefetch:12⤵PID:1892
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4352 --field-trial-handle=1872,i,16240333826000272274,3721426586565119233,131072 /prefetch:12⤵PID:3620
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1872,i,16240333826000272274,3721426586565119233,131072 /prefetch:82⤵PID:2408
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1872,i,16240333826000272274,3721426586565119233,131072 /prefetch:82⤵PID:4416
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1872,i,16240333826000272274,3721426586565119233,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD540a6d953bbb377ecb39799e52c1105d2
SHA1fcbd9f14943cec5135ea41a7f082e78544744248
SHA256db853214a4636757c67788fd9c60bce44556bd92a7989e92167db3a12739384b
SHA5120739c9a0b18910066fd1bf5c9e2f57798323de5763715efb70b002a6c1a128e75003cceb0c71af31924f27c6d02dcb4366e1de63532463a9ef326ccd32f30e15
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD55f8912f6d269d75ecf3d75c34f084e04
SHA1bbc00e7b1b70419c6f50b7a2c46bd425915aee54
SHA256b1aba720feeaa56a68f69a858b4d695033b21367da2977f9fb210d4fae51ed48
SHA5123558798ef08cf54328f6b3927e39973feb1e14b90788853666afb87d378a59d5589884b7c97ba42c05626c67a7541e63d55dcca27d39355f95b3b508bdf6d441
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5c61dae43d77989fb3a089906568add6f
SHA1de05da1a66abf38b40a79dcbc96f3cd7e2f83c65
SHA2563340f778ddb6c3648cd6cb5dd5e5fd0493e1539dcc145d29cc0d70ac757d329c
SHA512d9a49976e97056feb1aa9b73ebfbd039b20687af07f33ee733cb84dfdd436b013ea336e90bf12634613725aeab2d95b52798adfac4fad18eb3d120eb3a66dd76
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD528ca0f704dc473e2a659024661f78bfb
SHA1c24a748945535e340851439c38a45418c1a4fae6
SHA256d41ed064ef30fa872dece8ab9775f845c217e8bd9f7e9428a5ce6ec9aaadd800
SHA512fe69b767dfabc9b3e5bb755c7e9dc8b2df77a33b347aece7e7783f6bb3918cf194b5627ba969ae4b807da29b4382b520a8f10f17e48faeae7374a2a5c6838c58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
356B
MD5b2ea33de195c124657c772e2f962a685
SHA148fb94ab4a29c6d2fb945c39dcafb0642b5d64e9
SHA2568e828f075892d7eb71a262752542e0f620e560ff49c470648b3b4f242e1ce7dd
SHA5123091903776c34281b47e637b99a397ae6aa539a4d4569e1bfa5daf6cf56e369cc3c00fb7dbbea717bc7f7fa151c2b5b1d0784e7de08b309dd88b3a7f936cdb2d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5f53dbfc23169b5db9cec5e3e1630170e
SHA1814f7435e8d1b79f33263d7444982555a6fa70c9
SHA2567dff36e145ab57a9017238937d6e1ff42ae9c6c2d36e62e9658a5e9d7c6538a2
SHA5129864b05e58cef490a9d8e4d4e314aff35db760dbba5a40e2fbeeb3854d9942650396516164014fe963d19294f3c2f116243d94283a4b90d2cf0b13d3de09f133
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
138KB
MD57968de22d64123c7501fce90187cde17
SHA180de6bcadcc4a00208446d886f1380ebe4fe3324
SHA25621f96ee0c9a131da5aaafd86d18d97fbfa6ce551fcce476abb3c049058a9c692
SHA512996bc4994d9a8422e8caff3d9511690bfbeace4526f7876ab64d68f4622b0bc19f23ba44853bc28c71f6622a0a59951eb9e04b25ae6d31483b68403de8684865
-
\??\pipe\crashpad_1048_SEDBYCNEJAZCYYPCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e