Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 04:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.prweek.com/ad?target=https://share.hsforms.com/1gOCay30KTIiUoYoi07WUxArq9o7
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://www.prweek.com/ad?target=https://share.hsforms.com/1gOCay30KTIiUoYoi07WUxArq9o7
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133639372108190837" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 532 chrome.exe 532 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe Token: SeShutdownPrivilege 3156 chrome.exe Token: SeCreatePagefilePrivilege 3156 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe 3156 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 1344 3156 chrome.exe 81 PID 3156 wrote to memory of 1344 3156 chrome.exe 81 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 2484 3156 chrome.exe 82 PID 3156 wrote to memory of 4600 3156 chrome.exe 83 PID 3156 wrote to memory of 4600 3156 chrome.exe 83 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84 PID 3156 wrote to memory of 992 3156 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.prweek.com/ad?target=https://share.hsforms.com/1gOCay30KTIiUoYoi07WUxArq9o71⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7cab58,0x7ffd6b7cab68,0x7ffd6b7cab782⤵PID:1344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:22⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:82⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:82⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2784 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:12⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2792 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:12⤵PID:1360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:82⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:82⤵PID:3716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5056 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:12⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4876 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:12⤵PID:548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:82⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:82⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:82⤵PID:408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5072 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:12⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1544 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:12⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4008 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5044 --field-trial-handle=1932,i,767971506097736754,1641476989552132098,131072 /prefetch:12⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5966b0898f45be5479a509271185286be
SHA1f5b874db771c62077d3e51a0be86e1fb3b4a975d
SHA25607e9b3f90f0c75174b693873199e28a6580bcba601dd28e38c2e5298a9688c02
SHA5125e14e7328770b7142555ce8db0b3ff7152b609c2544b6712b9b799633b24a65b8c8158672ffbd7c4b9547661a0db6f6de3045c3c60296c3f2b3bfb3149ef410d
-
Filesize
257KB
MD59b2baf7e4400289bcfcfbcf226fc5d1d
SHA1b67f0cc70bf76f4e93e02925f6b1db54a144ea4f
SHA256e4c7352a55026fd5911efbe802162a1ced8c926823b5436a26c39e6c0b17eed1
SHA512adce7cfd31e9623f309bbf6fa9746be351193555c707423d7acf152e426db38caa472325953c185c4ee181287d761dc937739de39d3fab52ca0c8d25c0a13cc3
-
Filesize
257KB
MD5dc8a1c8ee2c5ec6f2ffd7d0665ee3dfc
SHA132f5b329e793e0daeae87906906c9df42e737ebb
SHA256355dd459d1a09bae44dba106125d6b4b1b55d6d56e64f533bc3ff9f89d7f783d
SHA5120524b27e9f0b9eef1bf449a676dbc17fe3772c27b9f7925c1711dadf2535acbd7feda3a2dc68a618cf0ead810251ec9f5551a59b69726d360b53a8c285763b71
-
Filesize
91KB
MD527dd0caa34706cb4b70977894b83b4fe
SHA1a9274eefeeb03be1e98ddbb6c87337cb668499be
SHA256e54fab8f2d1ba06fa52c1ac7592e57c2368c5f6a52f2abc5889f029fad734303
SHA512368627f37bb280d6bf544d334834aa4c5bb4230193cbd0da0941b5730f89597c2f12b4ba247fc801956605df2ffdfb2b138c9521ebcc795e2c7a0464bb641fe5
-
Filesize
88KB
MD5480c8d0d9e7860d06d40cad2ca8ddd07
SHA17ea1fdfc2be543122f21ac5b05b8c919ee355336
SHA2565611b0c5a17d7bd74f5cc76cc658189140b400b02d4bc2af29f7b2553e8079e4
SHA512fd4ebe03f5f8b992e81d2ab7b2345758a64743a599a9ae769c56bac3b85a40baf73284db380090eeb092b5e845b7b5151cf96045bf43e9717ecf51505041870b