Resubmissions
27/06/2024, 10:22
240627-memgmawdra 127/06/2024, 10:21
240627-md1b4awdng 127/06/2024, 10:21
240627-mdn9tsyemn 127/06/2024, 10:19
240627-mcwbrayekm 1Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 10:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.therwp.com/forums/archive/index.php/t-6896.html
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://www.therwp.com/forums/archive/index.php/t-6896.html
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133639573884498665" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2308 chrome.exe 2308 chrome.exe 4788 chrome.exe 4788 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2308 chrome.exe 2308 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe Token: SeShutdownPrivilege 2308 chrome.exe Token: SeCreatePagefilePrivilege 2308 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe 2308 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 3436 2308 chrome.exe 83 PID 2308 wrote to memory of 3436 2308 chrome.exe 83 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 2364 2308 chrome.exe 84 PID 2308 wrote to memory of 668 2308 chrome.exe 85 PID 2308 wrote to memory of 668 2308 chrome.exe 85 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86 PID 2308 wrote to memory of 3944 2308 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.therwp.com/forums/archive/index.php/t-6896.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff86a12ab58,0x7ff86a12ab68,0x7ff86a12ab782⤵PID:3436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1916,i,2107523293424883422,11427514841262285623,131072 /prefetch:22⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1916,i,2107523293424883422,11427514841262285623,131072 /prefetch:82⤵PID:668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1916,i,2107523293424883422,11427514841262285623,131072 /prefetch:82⤵PID:3944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1916,i,2107523293424883422,11427514841262285623,131072 /prefetch:12⤵PID:1008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1916,i,2107523293424883422,11427514841262285623,131072 /prefetch:12⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1916,i,2107523293424883422,11427514841262285623,131072 /prefetch:82⤵PID:2088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1916,i,2107523293424883422,11427514841262285623,131072 /prefetch:82⤵PID:3236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1916,i,2107523293424883422,11427514841262285623,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4788
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58606d74120fad82dbc0007c8fff9c4f9
SHA1871c26d5c0381acb45eb43633892d3eac4430fa0
SHA25620f110268e7a1a70920e358cc19786f3a5f2f6ef59be14f35f68e0f0ef81ebc0
SHA5123dca233054297eef8d0bbd745ce69fa13029799888aa931cac044e258b54fe1ad12fabb70638d2b2093a56f4291eeaf601896a962c4cfec4d1f4be8d8b135cb7
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD56645f9f56b953d08dc68ea88e3a78201
SHA19d84b11b922336257297cb2b9965bbc75f70de30
SHA25603477b99e0e5a57fb1df2e1b61e0c111d23b2e62f7899ffe3e556bbd0a3e1c3c
SHA51239fe29ac1d08a74d8f53a7edf78b8862eeb298b6ecdf39f8e514f3b8fd7564eb5173ec5337c7256d0cb6f6489aedfb1a9dda4f657a7e73495cfb439506999b8f
-
Filesize
7KB
MD5e82321f31dab20d1a7aef78298d2126c
SHA16fa174e203e1c2d354bad11cb277189d1dbbaae5
SHA25664fdd2b443f18d8f3105fedccb15611aeaf32814883f8141ff667f96e6fe4fd0
SHA512f82d8572138d434fe1839c2cdc37f9fd973f02b39a1b136fbd282a87543b7052eebc9d133b4e6f6ec740cd40dd0ef3c86665cf5e6e7737e7d6c027af9923fc9b
-
Filesize
7KB
MD549b0f623c42118908d2c6806c273d17d
SHA1a50070b0cfacaad606eac86a512fe5365d4ed992
SHA256d3265f0ab5b8935b9e5a19e08799d83dc65db254a77c0d9a413645eedbcbb2cb
SHA512a29f65ed4507df9fd3de4ff2cdecb37688bb6c3b1447ba76dd5f1d491ac4e2e1b7ce48aef9e5b5c186e69223733e99a009e984303efdd5423a5c89d2f6d07a62
-
Filesize
138KB
MD52a436618d6e2f73a169dcf5ce4c21bde
SHA128097eac1a44e33274c093c64ef373ab820f0b9d
SHA25618d500168c7bed966d8fcc295d7d35711dfdcb3dcc145df199e766d1a3ce66c7
SHA5120b9c0f091d24b25c695401f5b69976102a6dba63bb43848348c3cec7eded8ae2e9c1fc1b10aad18abab5d6aef1cb5f9390bebde13459f6e388cb9ce0eaef9eea