Analysis
-
max time kernel
93s -
max time network
72s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19/06/2024, 20:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://elines.coscoshipping.com/ebusiness/cargoTracking/
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://elines.coscoshipping.com/ebusiness/cargoTracking/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133633013619487410" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 728 chrome.exe 728 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 728 wrote to memory of 2264 728 chrome.exe 81 PID 728 wrote to memory of 2264 728 chrome.exe 81 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 1560 728 chrome.exe 83 PID 728 wrote to memory of 2240 728 chrome.exe 84 PID 728 wrote to memory of 2240 728 chrome.exe 84 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85 PID 728 wrote to memory of 2900 728 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://elines.coscoshipping.com/ebusiness/cargoTracking/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd17afab58,0x7ffd17afab68,0x7ffd17afab782⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:22⤵PID:1560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1856 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:82⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:82⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:12⤵PID:2124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2920 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:12⤵PID:4356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:82⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:82⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4616 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:12⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4124 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:12⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3912 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:12⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=740 --field-trial-handle=1924,i,5398072519493697377,17210300834540418301,131072 /prefetch:12⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e06a9968-b1cb-412a-bb4e-6c8f842418db.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD52347335b9bfb1e0e8128cd99de7fdfe7
SHA1189abf3ef155df35ef3dac5522527b6b9639c00b
SHA256c0b328c9985f1f7c5621558f2ee94eab5c9434ffb03f0b1fc1ad4c222fc6a27b
SHA5122536090f0aeb6edff1b0e7464c293d7f78e94e97fb31fadea04ab78223287b19771b43e4174e3dce0492f2ebec12bc732c91ae46b65eaa0b78cd3b63a330a92b
-
Filesize
129KB
MD5edb3468a182e27dd8ca165a573982efb
SHA1e492947adbc691d18a3bbe0d585045d758f55321
SHA2562dcfb3c674810d96437e27ffa1e78c14115187734cf6ae15a3b95dcfda5f5550
SHA512622cc5cdd7a843a5bcd228dde9de80f23e7a77c3c99a414078d5adf76adafae30ce577cce0bcf122ebbfd82b82b74a0a411d3accf5dac9ba3b32fb7d5ab9dbf5