Analysis
-
max time kernel
300s -
max time network
274s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 19:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.reggina1914.it
Resource
win10v2004-20240508-en
General
-
Target
http://www.reggina1914.it
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637326718720769" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 4948 chrome.exe 4948 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 3008 3980 chrome.exe 83 PID 3980 wrote to memory of 3008 3980 chrome.exe 83 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 4272 3980 chrome.exe 84 PID 3980 wrote to memory of 2120 3980 chrome.exe 85 PID 3980 wrote to memory of 2120 3980 chrome.exe 85 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86 PID 3980 wrote to memory of 1908 3980 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.reggina1914.it1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0854ab58,0x7ffa0854ab68,0x7ffa0854ab782⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=280 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:22⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:82⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:82⤵PID:1908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2820 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:12⤵PID:1232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2828 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:12⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4388 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:82⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:82⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4596 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:12⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3280 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:12⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:82⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:82⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:82⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4372 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:12⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4316 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:12⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4720 --field-trial-handle=2004,i,8204847456734177828,16884034147751375981,131072 /prefetch:12⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5e588953518403228b56270855e77ca80
SHA15a8bfaee611c2b989f5e28048aa188dd9522affe
SHA2569632f71ce7e27c4a76d09661e438a37ef851b31347f6ecf1b263a277b696cfda
SHA512844a344cbedbb309bf80058cffd4854b449e20e8cce4b14aa42f07a68953b781482cf4bcbc5cd8178148b228b3e118fff8245a436b01099ac6b19063fccd0889
-
Filesize
257KB
MD542732da8c3199c547a230d13dfd7b8b2
SHA140c9d369598ecd85b3624475d8f6fa36ef8dc1aa
SHA2561d3a0768cece998f09ac8cc363e1ac8c130651a534e422669c1a5112222e63d1
SHA5123e51342d64e30d9f9feb1dcd0187b0a8c238c4b9343079208a87b728e6c74b3f521fdbf557f684d0eec2073f33879d55ee59c768d36a0484816021e91ad5492f
-
Filesize
257KB
MD5f45b82bc85838faabe557cc05fdb8653
SHA1a30e8bb99663917052cc7b6200a6d2dc0748e939
SHA2566a4a2baad9434e8146f0fe8d72417f2402df9dca3cb2a1e4130c5824bfd90ba1
SHA51262a96df8ee823c73e2b840100633e9ae5ff20ca39672ee3677a9d6d265230667d8b216379f803346de1873c358d0edd4609f33e3108dfe2aac74f52cea06b557
-
Filesize
91KB
MD590671070d6d317a64bf1c49087e629a9
SHA134500021e5725b7b740a7344d557f1865729daf0
SHA2567fbfc9570b43ee708ae59728019159d8d55effeb19a90e78189e0ea67357032f
SHA5128728d190101803b6a015df927fa93d720b99e25e980cac927526da66a76e97e83bcbddbf237314a884d2961a361ad6b86958bac04e1897edaccfe8da9bc4fce5
-
Filesize
88KB
MD5a984037e6cafa4a573397bb55ea3962e
SHA14313760bc230d4036e83e998241d5f0b43577f5c
SHA256a2206420aee77287633c1581f485727761f2a0195e8d83dbc10ae760411bcbf5
SHA512927fd750a4ce8c86623552c596e25d7c29603ad9d650c83e06d1424b927d59fb752f672a15b92487db908721e9b49321df4b6814e2c59eabe55e980b529bd9ce