Analysis
-
max time kernel
1799s -
max time network
1687s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/07/2024, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win11-20240704-en
General
-
Target
sample.html
-
Size
8KB
-
MD5
ec8ade04ae10c298dc3816ca818351f7
-
SHA1
fce8f96b382d8c4b18b2db983038650138d97ed3
-
SHA256
a834f8464e225b7597eae86a956d0e73d6b55b3e78df888edcd6fe089c81d434
-
SHA512
7309184bee01f7e4981730b298b8efe24de8c7e918b18690dc324de4efa987b2c02beeb7dc020dceae7acceb14880ee3f8b4bdc7f8b0d31e9e16fb1853667776
-
SSDEEP
96:Otes2fmwXfAWPBjvisHGBE2lcPOjVxodYwFOallmpKTQ1Wtll:OtK+eAWPVGfiGx/oOalgwQGll
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133648867614773014" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3004 chrome.exe 3004 chrome.exe 4684 chrome.exe 4684 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3004 chrome.exe 3004 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe Token: SeShutdownPrivilege 3004 chrome.exe Token: SeCreatePagefilePrivilege 3004 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe 3004 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 1140 3004 chrome.exe 79 PID 3004 wrote to memory of 1140 3004 chrome.exe 79 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1636 3004 chrome.exe 80 PID 3004 wrote to memory of 1068 3004 chrome.exe 81 PID 3004 wrote to memory of 1068 3004 chrome.exe 81 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82 PID 3004 wrote to memory of 4172 3004 chrome.exe 82
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd4458ab58,0x7ffd4458ab68,0x7ffd4458ab782⤵PID:1140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1804,i,17609660669246090854,8174195848929105689,131072 /prefetch:22⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1804,i,17609660669246090854,8174195848929105689,131072 /prefetch:82⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2132 --field-trial-handle=1804,i,17609660669246090854,8174195848929105689,131072 /prefetch:82⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1804,i,17609660669246090854,8174195848929105689,131072 /prefetch:12⤵PID:3492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1804,i,17609660669246090854,8174195848929105689,131072 /prefetch:12⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 --field-trial-handle=1804,i,17609660669246090854,8174195848929105689,131072 /prefetch:82⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4472 --field-trial-handle=1804,i,17609660669246090854,8174195848929105689,131072 /prefetch:82⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2688 --field-trial-handle=1804,i,17609660669246090854,8174195848929105689,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4684
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fb3eeaf8f66ae3003c40d2d3246a9a5c
SHA185bc142e37474fad02a6f1e485e7efa71d46ad98
SHA256d92bc503c4259731338b6751296d5fee8f3aed24d88716a76c20ff7c6e90d860
SHA5128f5b813ccda0f75110651cf26ca793d10c4a3b908dd5f31fb91a62e5cc6f4067b4ea362cb30cfae8b077cb26c6d4f799419b0b59120223e5f9aef63d086450d9
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD541e724d6a95ba1907251f5321c532e7a
SHA127a7cedd90e30f5ef2e21148711715670c39e5bb
SHA256d1036d5625e85dbcbae7eff830591dc683c04b59d5a2e2c0602355f5dd98e7e6
SHA5126bbfbc4c28c565c269a9ebc5a5659d777abc8bde1b70562482390f627894762d9ea1f1e8ec791532e0a8e7c088332d5cf0aeab4fdcd8a3d84f2094bd0c5bc621
-
Filesize
6KB
MD5bc1f41f4fcb6816558709aaf9d8d3317
SHA1abffa017939ffd0949b0b972c3f9edf7e8d5da28
SHA25623293ddfe5e73c43c13ecc2ea30a9ffd7a65780b454311c266cf1c8ef8bfcb79
SHA512d21d7b9cecc3d213da03e7463cfb56dc89bdb4ca63fe20c2fd40dae083c9051e62b437cfde64f908015c3de0edf76f257342c4a808f9f2ac793b419e9662341a
-
Filesize
144KB
MD55c2656f4f9fca2c538eb4767920a7aaf
SHA14dff582c1b267e6cefd8c9b53ababb774eaa2b70
SHA256792211794a2102336c05241dfc015ee7eb4eac78092b91c6ec804a183a72e854
SHA512857bacb31f43dda3ed478d5df1abec14c5d2627ffabc7ba5feea26a076d511842ab6783d4d5de91ef9b38f2db7c194d98414655ded52e2c44a6a251df1cfd7c8