Analysis
-
max time kernel
38s -
max time network
34s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29/06/2024, 02:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://77.105.133.27/api/crazyfish.php
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://77.105.133.27/api/crazyfish.php
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
http://77.105.133.27/api/crazyfish.php
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133641012997720919" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 920 chrome.exe 920 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 920 wrote to memory of 2896 920 chrome.exe 74 PID 920 wrote to memory of 2896 920 chrome.exe 74 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 704 920 chrome.exe 76 PID 920 wrote to memory of 2192 920 chrome.exe 77 PID 920 wrote to memory of 2192 920 chrome.exe 77 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78 PID 920 wrote to memory of 4664 920 chrome.exe 78
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://77.105.133.27/api/crazyfish.php1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc54719758,0x7ffc54719768,0x7ffc547197782⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:22⤵PID:704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:82⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:82⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2620 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:12⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2644 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:12⤵PID:3676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4080 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:82⤵PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:82⤵PID:1224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4320 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:12⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4212 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:12⤵PID:436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4252 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:12⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3256 --field-trial-handle=1584,i,12882254059465824601,16915349344062408133,131072 /prefetch:12⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD543955d6cee78cd49dcf3ab142aae351d
SHA1cee2782d020d87936c815e7b7e6a8f4a623fa814
SHA256720f8b68fa4a9084412cd82b73f951a9c25b02ae7df120a82eea745f5db07906
SHA512bea3aee33ef3bb77f3598037e7b32e9dbe5e2cf40958a6a3f4afd6a10d54a22dcd283576bd9943877910b5450fbe8cc3dcf07368e220ce95caf34f91c24451ff
-
Filesize
7KB
MD512d04b45d7118bd45eda0f64bd643fe3
SHA1c1c03a86db42de528ab63a74abaff60c57c74185
SHA2568f512d760827527c7a96e3b06235d13ac243f364ae3e77484b14152ed76aebfa
SHA5129c304bab202460abdceb5adbab121d65c41c561ffbbcd2da3d85f0f3e3d7bdd900eb7ded1ff1ebd46926f2996e3a127e559667ba42549a5f2880479dd5d76168
-
Filesize
8KB
MD50dc7678b1bb831ed94a13b67c56adb7a
SHA1d0439a9228d609f71bf299b0d7d8874dd31403f2
SHA256d012eb88fa4ba13ed0460c9652cc83b9e01024db2d9e79036cc909065d20e697
SHA512a083197336913677719fa62ab9259ca01dfa2688237085317d7bc12bd28bc62abd61d9681f5f3183456ff233208b5627a4b9e65eca51f484ce263c335ca0aace
-
Filesize
136KB
MD56961b45956baa8d0df3ec20ee69554fa
SHA11e501e37d80949eb3d61695288a5efc0f528ca63
SHA2568975384ebffd3191a85cde804aa72ee51307da47f51401b5a9b0a0ef0f83b420
SHA51206ce5a5c2c5079018ae7210a51601e83d7c551a8383d9b9990dc266f6aab1b8c6bd6cba6eac51c0aed70963b8b843e2e45e5fdddd34621b7c0275fa65e05d4db
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd