Analysis
- max time kernel
1199s - max time network
1162s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
04/07/2024, 23:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cspattern.com
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
1200 seconds
Behavioral task
behavioral2
Sample
https://cspattern.com
Resource
win11-20240704-en
windows11-21h2-x64
8 signatures
1200 seconds
General
- Target https://cspattern.com
- Sample240704-3ahkwaxeke
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4776 chrome.exe 4776 chrome.exe 3164 chrome.exe 3164 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4776 chrome.exe 4776 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe Token: SeShutdownPrivilege 4776 chrome.exe Token: SeCreatePagefilePrivilege 4776 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe 4776 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4776 wrote to memory of 3360 4776 chrome.exe 82 PID 4776 wrote to memory of 3360 4776 chrome.exe 82 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 4712 4776 chrome.exe 84 PID 4776 wrote to memory of 1100 4776 chrome.exe 85 PID 4776 wrote to memory of 1100 4776 chrome.exe 85 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86 PID 4776 wrote to memory of 2744 4776 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cspattern.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4db9ab58,0x7fff4db9ab68,0x7fff4db9ab782⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1908,i,5483467483722286851,15439105392626832369,131072 /prefetch:22⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1908,i,5483467483722286851,15439105392626832369,131072 /prefetch:82⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1908,i,5483467483722286851,15439105392626832369,131072 /prefetch:82⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1908,i,5483467483722286851,15439105392626832369,131072 /prefetch:12⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1908,i,5483467483722286851,15439105392626832369,131072 /prefetch:12⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3916 --field-trial-handle=1908,i,5483467483722286851,15439105392626832369,131072 /prefetch:82⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1908,i,5483467483722286851,15439105392626832369,131072 /prefetch:82⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1000 --field-trial-handle=1908,i,5483467483722286851,15439105392626832369,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3164
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 f543e204d526af0a15c3e286f1ef18b341f5485ff557e6c61137f137bd91058a
- MD5 484fba27bed778fffc3b2e0efa5e818f
- SHA1 7f419f4ccf4cd491cb07e832c28b6044188f67a8
- SHA512 7d6b9fd5e675f817d63b8cc6f23b2086487a8079b4de27f5a22d083d68a7adcefb981e0206da1955664c1d6f8588a03f8c6f8b6a4b4ccc20fa58b60e5253cba0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 72c745671788795441bb6843a28b76386dca7bfc6abdf698a69f7449a11a9c13
- MD5 82d83e2ea4e44c442e99c5294e22c09b
- SHA1 5f0e5ba29f94d7b54d118ccfc5968c518a20320f
- SHA512 4f33907222262abdfd003d1d2eccfb082c80455b4f11453ef1fed1b913b62beaa38b4a8873f6167e082a394d28fc205496f342e32357cc2836c8a71a20011857
- SSDEEP 192:oec7gyOaJxiNm8syh+FT37i+P5tjEsXtScR:oecTxiNsyq77i6tIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 144KB
- SHA256 bdabd19ca5192befb64ae990a4b215d67908d26f96765e125e6c4cb16a342933
- MD5 e2a89828e7421e88bec74b5485c439fe
- SHA1 8aa7719440eaea6b89ba7400f5e90938540153b9
- SHA512 a538cde54e6ff6efd880b5d722ca2966a4d541f6d12540dddc87753706ea14dbaee3253b58581d8ca1ad0ef473175697ee6dea2b31b588d0b67416bc5089b6e9
- SSDEEP 3072:5vgMGZw018MGaJu8ZsV25nNCH6Oo7YetXMGAzG:5vgMTjAuH05nN4T4tcGAzG
- MD5 SHA1 SHA512 SSDEEP