Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 22:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.woff2
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.woff2
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133646921113624640" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3360 chrome.exe 3360 chrome.exe 1960 chrome.exe 1960 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3360 chrome.exe 3360 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3360 wrote to memory of 3000 3360 chrome.exe 82 PID 3360 wrote to memory of 3000 3360 chrome.exe 82 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 4628 3360 chrome.exe 85 PID 3360 wrote to memory of 3720 3360 chrome.exe 86 PID 3360 wrote to memory of 3720 3360 chrome.exe 86 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87 PID 3360 wrote to memory of 4132 3360 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.woff21⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1b71ab58,0x7ffb1b71ab68,0x7ffb1b71ab782⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1912,i,244364527887074768,17215661703281776840,131072 /prefetch:22⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1912,i,244364527887074768,17215661703281776840,131072 /prefetch:82⤵PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1912,i,244364527887074768,17215661703281776840,131072 /prefetch:82⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1912,i,244364527887074768,17215661703281776840,131072 /prefetch:12⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1912,i,244364527887074768,17215661703281776840,131072 /prefetch:12⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1912,i,244364527887074768,17215661703281776840,131072 /prefetch:82⤵PID:704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1912,i,244364527887074768,17215661703281776840,131072 /prefetch:82⤵PID:388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1912,i,244364527887074768,17215661703281776840,131072 /prefetch:82⤵PID:4380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=968 --field-trial-handle=1912,i,244364527887074768,17215661703281776840,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD547353d8659e37183677df7f1fa2ce691
SHA1d831c535ee76413f0f3dbd5d7089a672b5c53137
SHA256696c48cf540c3a746eddf5c4ddbc35e8e01bce0d6b3278819df63fef8ec2e3fa
SHA512ea952c5b758f625caa9d8634ea87cc66c25eefbb7d11accf7376f32185dcb669dd8b60fb1c0c4bfaf07104d151c14c7ef9d45dd7baadfd130469af5dae71280e
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD533f5b76f88d6e32298b05f23f0428257
SHA12069eee5ca46b35b7d44324bf059e491bcb0ad7b
SHA25689936c5802c4cb3a6df349e2d0224431fabd2339395d2e0164aa9d07aca01b2b
SHA5125361ac7571c73e9ac2a1f151054863b34c342570182b8ca64e13407bb6588ea65f765cec9e91cc894740e43e9a0f4b25b1829208416655bef7ad0c8f5099f5b8
-
Filesize
144KB
MD557d9f6ee34923cbb72de38ddabe20089
SHA1bc2e97a99eb9ee9f65f74496daecf3c0a4b242d2
SHA2568432c3df14f09526564edbb77b4981c05ac493ea0986da5c2057ec853d568333
SHA5129b01dd7bef6aa8fe17159f024848f91bfe72788b38e228e4e82f0eb0ab3419af80a709610aca9e1956f73de4b1e2cfae34463d35dc10d2f0c9ee4f2d2b028c66