Analysis
-
max time kernel
599s -
max time network
596s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
01/07/2024, 10:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.ojrq.net
Resource
win10-20240611-en
General
-
Target
https://www.ojrq.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133643045130976072" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 352 chrome.exe 352 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4468 wrote to memory of 4976 4468 chrome.exe 70 PID 4468 wrote to memory of 4976 4468 chrome.exe 70 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 208 4468 chrome.exe 72 PID 4468 wrote to memory of 4864 4468 chrome.exe 73 PID 4468 wrote to memory of 4864 4468 chrome.exe 73 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74 PID 4468 wrote to memory of 4492 4468 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.ojrq.net1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff536a9758,0x7fff536a9768,0x7fff536a97782⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=244 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:22⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:82⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:82⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:12⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:12⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:82⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:82⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:82⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:82⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:352
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59831aecb9fb478d51eb9f658ea8431e2
SHA1fd4b5ef447cc4df39ed170b282c702c37b67b5fc
SHA25614e025fcd6a13878a3fc15a2e33f5f85d389e962d3a2daabe847126fdc6fad3b
SHA5126e1ad45a07458f38e135dd2e2ee2632b5d1c31b82d2e02672565e0a267b56bb752341022d86f4dedc1c99fdc02bb1ef1adc6291eff0a63736209d47cc8a04d7c
-
Filesize
873B
MD5b2a07e7f137ea6dbad08adfe8f9fc982
SHA1b7891221396bfd23c86329070009c2d7150ab55e
SHA256c01dc8fdfd3318a9b8809427e5afceb28ada6f400d64f3817c747ff0bff0e304
SHA51209981310e1774b3a422a04c16ad46ae61785afbd4dece511866beb8a6c17a92ae080036314ff876bd61c50dbdb0b827533644642aab094a74ab8de73c226948a
-
Filesize
5KB
MD524c7f65d02fa4265e121486f153ffd04
SHA126113bef8be3f90484ea56de0dc10477909d9682
SHA256d403f1d0f8a52b459473e848b74c1c3a4e4df805ed5be6c3c0ad32d289f2d883
SHA512a550e3e7ff331f2af0b003d98617df5eeb80bb8c3fb9e733abad5559f9918d3cb6a810ab05149a1c2f1f3e8619e4ceb200385f2ae1859d49e7091c2e05d84ebe
-
Filesize
5KB
MD56088c358a2641d0872be3f1bb2cc4252
SHA197ae3da559082bd2c7aefda8d2e63937fb1e5728
SHA2566ab60c026087fda9ec016726b2772ec0b930f777f4747e3b76a2618eb9c0722c
SHA5129cb0ab4b07719f331e7497624bf5edada6449e6fc91a3f82a0238be5e3fadb2440f0c1774e9660207c56b821c111c19c5e5e7e7387098613fe0dfc2ea4d9fae2
-
Filesize
5KB
MD5603ec216204da8236c4b1aa2ab1cb732
SHA1d4a7b252b83b97b6fa5de992b29561cd4bdb1a12
SHA256cb45ac22b422bd661a003bf70cdada80a796fc6a97b630d72b0dc9e57558cf4f
SHA51256069ccdc30e0c476bdd08a366ad25150d769ec31cc758715f45f5de1e3aa8c6a5412a7391050b49624a627c4a897c581ab49bbe68c16b8d92e5aa8f43c4916a
-
Filesize
150KB
MD59b892e947a53faf0df9a5d3109fde5ae
SHA14fb288d85c6146ae45bb79ffc72938094e7a791d
SHA2562b31e8eb24807e827e89aa1bd90f011d9eb65a8efdf5ff7aa753d4a7ece37714
SHA512ab5b548e89813b709890f1813241cdac8b404afdcc34b5d5194a9fd1538806ed566c1aaba1b371b84e003304cde371f4a58b259fa13b74ffaac0d7969c2645d5
-
Filesize
191KB
MD5e436eb98527c8929a67379ed4c371466
SHA17d464a459b98e49fd1d81a731c2f220a04d23f4a
SHA2563024826a4bdb9828770d0911e2b3582144888044cb18c64f32714388dcc3b796
SHA5120bfd8d6225dc61ea019f9a6a80abea908e6d666acdfffc5976aa951516336065b2ce3bbe7c4119fd09ceda619d652764507573b1224059c37d190da2812dd3e6
-
Filesize
150KB
MD5bf2707dde098b1d041cf754d4045c373
SHA10c1a5246d2dabeb5b25ecb9d5409d7d9f4704cfe
SHA256f030b3b1cf65d063f6ccf6bd46678a9b8c9c87b9d997fcaef392d747e1f99353
SHA5129bd782fd31f19bb7e799164d35ec0effba433d56227b4cb8db413cf764586f006ab1d024343b23cbb7bae7c00aa8d09be55a93f9c95c77ec8aef85953f9a9272
-
Filesize
150KB
MD547f470a4d5c0c75241dfe6042f648b3b
SHA1aca70a4d2acbe31393babc1dc8ec5b5a6f55bdfd
SHA256c2c362e88ba36fbfdbfb0eae5007c838f92bfe112d032927f9042bcf20d5144b
SHA512c58a6497dae12cdc2d57fc968d3c69078a4782e6ddfe8a2ace25431a8d28c582adfb4f8e7f45368a223685e426d3d3df232255e3e596d86247e49b6b4e484250
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd