Analysis
-
max time kernel
599s -
max time network
590s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
03/07/2024, 13:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://disney-crossy-road.en.softonic.com/
Resource
win10-20240404-en
General
-
Target
https://disney-crossy-road.en.softonic.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645109524112148" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 588 chrome.exe 588 chrome.exe 592 chrome.exe 592 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 588 chrome.exe 588 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe Token: SeShutdownPrivilege 588 chrome.exe Token: SeCreatePagefilePrivilege 588 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe 588 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 588 wrote to memory of 2596 588 chrome.exe 72 PID 588 wrote to memory of 2596 588 chrome.exe 72 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 3036 588 chrome.exe 74 PID 588 wrote to memory of 2944 588 chrome.exe 75 PID 588 wrote to memory of 2944 588 chrome.exe 75 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76 PID 588 wrote to memory of 2928 588 chrome.exe 76
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://disney-crossy-road.en.softonic.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe349d9758,0x7ffe349d9768,0x7ffe349d97782⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=300 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:22⤵PID:3036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1768 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:82⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:82⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:12⤵PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:12⤵PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:82⤵PID:3764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:82⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4524 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:592
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD5147d3c47a5142ba47b8526a729835997
SHA1637ece7d8d76acf796586a0c289137bd5f12bc64
SHA25657a482bcb6a445f08d5a04f604c3cf0dc858a0d6336a4a38a01f171d55350d50
SHA512a1ed14cd5d34bf678438de6e1cb71c5c02115dd0a471266b9f437fb4322f665fe2d78ca8e9119a0d45c480c7bc12d44b18df27fe4bf5f98901a254da696c0ad5
-
Filesize
528B
MD554fb5fef02f7008cccfb8fdce33e8621
SHA1d99991a5dd6589eb9e11cfde6959900e9f163e7a
SHA2560846c56281f5162fe8a662e6d592ac4daee64facb57ad4204eb46371fb542262
SHA512ea0a740dbfc5733baf7922807e37ac7d59a7ba90c6c1f52ca954a727e0fe5561fdeceb0df3248f27cd068bf42ac481a5c3aea0471e11b5e107da576eeb5e05d0
-
Filesize
3KB
MD5bffc3e11fe9dc5f183381fa303449758
SHA1ab9749a64cd3b3aac41fc3e4bfca5bd12df86614
SHA256e8ccd9b0c3d5b4e4d60ba6e244590a40c6139cf965869d52e57390a391238505
SHA512b141a654ef7e73a13d79d461b8f78361cb60819ab1e16211d9b75550f66c72811d7ed9917d0529f751bdcec20840b2ef189ab8c5edbddd287fd9e49b39377d45
-
Filesize
1KB
MD5f09af4700b6ffa1b27f56bb11ada9cfc
SHA1baf6f5d696d30e8926682f0003dfb731f8970067
SHA256380e827252988d04daffb59a5aded33ad261ec2b008e8e0ffe2698218f1d5683
SHA512959b8346c0c819a8fe51e8b7e85c3ecfc2015258ba2fc5a5a71a55af18fd0f3839900eeea3be9ff56a8445a06527f7c32493bc9c73b48ceb18daca39488f1611
-
Filesize
1KB
MD5c5c606e79f1f4355ff46696ba50b478a
SHA1ef359e2dc47e0c119e2719a1fc78a204b4d37766
SHA256faa79afd7ee6baf7f60e17fa67b40bd11139bd0e65972fe92c50604a7989e0eb
SHA512bc768c5d55691012ab220cbf49c926c520ec2f670b3776f375b876883188d3846393e012087c71ed797e5fe9b2c3fd8417090bb9852b75cb88b9c4e21c80ac0c
-
Filesize
6KB
MD59c7ff8f2f7f21f245534f3ee71a67be0
SHA1c6e046a1f202c9152df4d6cc88faea7db8f4769a
SHA2560c332e73524cf3821f57b956a9a610310614dc32757765b99fcc8dca0c0f9f65
SHA512f3fa536e0567ece2f0ea70c88e990c349fbc3c9f6152d9e9fc723563fe544ce102644c90c46dcb2d67ff24fe8db35aa3543034b9c2ab3ac60f1fe6d2a811e49d
-
Filesize
5KB
MD5bc5a52090260b995eba8a6462d1ecc16
SHA1c3bddfc07e7b5623fa162980eacabeb0fcde9871
SHA256f168bddec5e2b3c09a635bc4c30fc50ea3016653a35fd2e4e040706911a25755
SHA512b865bae68bb49f6e3ede6bbd26be497d325b0933827b63406ba34195802f68709e2eb86e104fd65982bd9038a445be213dec71d99360bb6e2f4bfdd23247bc71
-
Filesize
6KB
MD51f1c3d7efb99504b2583a906898c0e38
SHA1786ea71ed425d9bb3212cb7aff8caac93c65f486
SHA2564fb2080b45a598d5f4aebc4a04e30045b52d2afd6299d032849e82fdefd8e493
SHA512b98709a1d474d728547a0a789f5f71f921c7a7ad43dd9e170be344cb02e8ee3cc3c36d3d64456c7413006d2f331fcabb3df0e647a3402893936c9aa94e6e81be
-
Filesize
6KB
MD58cf8fc1564e25fbb96241882b67dd8f3
SHA1b91fcc468c25b69eff554b7e8a42043d182e90d8
SHA256cfb7db2ae377d568dbdf8b118f36a93e0510271f19ba5bcf077d78f7f0b736f1
SHA5128d583bb46e0bac6533874195d90f1e408f69dcf853b0ad3ba58e0f2c48d4e99f93697b54f0c4c8e0d3d449006258391297e66045df78526b83c734e6a7720d49
-
Filesize
136KB
MD525c99ad385bd24d9893a22c6f5d145fd
SHA1b910d3962c6adc9043eb601312fe652bad1b210d
SHA256b6b407e14043350ba37788fb4f2f46ae1d764eed35e78c39b79f6c095f2413bc
SHA512d9632c8d12336e6587ce054e7225bc9870f5242a705098e60f9c2ec992cf100197708cd4f4ccf9bdda843eb8fadf58a51c5212e22aab6ba7c603001d56f37551
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd