Resubmissions
29-07-2024 12:25
240729-pltkmasena 729-07-2024 12:22
240729-pj3qhsyaqn 529-07-2024 12:17
240729-pggehaxhqp 7Analysis
-
max time kernel
204s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
29-07-2024 12:17
Static task
static1
General
-
Target
run.ps1
-
Size
1B
-
MD5
0cc175b9c0f1b6a831c399e269772661
-
SHA1
86f7e437faa5a7fce15d1ddcb9eaeaea377667b8
-
SHA256
ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
-
SHA512
1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133667292820960619" chrome.exe -
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exechrome.exepid process 4900 powershell.exe 4900 powershell.exe 2076 chrome.exe 2076 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
chrome.exepid process 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
powershell.exechrome.exedescription pid process Token: SeDebugPrivilege 4900 powershell.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exechrome.exedescription pid process target process PID 2344 wrote to memory of 2772 2344 cmd.exe WScript.exe PID 2344 wrote to memory of 2772 2344 cmd.exe WScript.exe PID 2076 wrote to memory of 2476 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 2476 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3084 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 2460 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 2460 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 1472 2076 chrome.exe chrome.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk2⤵PID:2772
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff876c8cc40,0x7ff876c8cc4c,0x7ff876c8cc582⤵PID:2476
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1916 /prefetch:22⤵PID:3084
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2256 /prefetch:32⤵PID:2460
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2288 /prefetch:82⤵PID:1472
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3204,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:3104
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3440,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:2088
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4576,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3744 /prefetch:12⤵PID:5080
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4860,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4876 /prefetch:82⤵PID:2448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4064,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4512 /prefetch:12⤵PID:4008
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4444,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4832 /prefetch:12⤵PID:780
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3284,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3620
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5176,i,7903173634660899016,2221866722367640050,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:3404
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:1684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsStateFilesize
649B
MD559ba70cdd34fb53152e4760cafc24cda
SHA11c4caa0de3e1f6668eaa914a9591a31d4a39064f
SHA256cab5f64d55380ddc77105e61c183019f120568dfd01a8b251690c208f632c421
SHA512bccd07cb683aa91346d8af7018952b96a33508f07f173bfd98f3ec0601cf36c3914a856084cae94cc7b26f572d2735009ba2276a03ca3620f3e812ac950ea706
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5ffee278ab0dcc1f8bd445e87096b429c
SHA1f7463a40470d21aa808c37eff0e914f1118ee157
SHA25622ce904cad4077bc29dc30e07a4f6cbac0a93194975e339559471207caf54ba3
SHA5123afa9c9e883d6342e5cbcb348ab7cc470a18a22dbfababe22d76c49580add248d9f79fd9d247725ed6f24447d4ff6829b4c412322d6979cdac0b28ee207d0f5d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
92KB
MD5d1189fd18e46a25c7336829de75dfd79
SHA12a8ec13b5602f9500636f6f765f9a31ffca43bde
SHA256ff0c6e5dfabb6ba53e8c4e79f62e1b291e6bb5587da833bc6d5310c9b338e492
SHA5123f55121ffaa35cbedcd9b71f3af8d3c1b70e4e0cd7a680978a213e8f9233cf4e8d041685e485801372258145571839411defb985937d203dba37aec3ce2cc860
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v0vdf2nb.4hw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
\??\pipe\crashpad_2076_JQWIOIJJAMIWAKLQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4900-0-0x00007FF866E23000-0x00007FF866E25000-memory.dmpFilesize
8KB
-
memory/4900-6-0x000001C4B7770000-0x000001C4B7792000-memory.dmpFilesize
136KB
-
memory/4900-11-0x00007FF866E20000-0x00007FF8678E1000-memory.dmpFilesize
10.8MB
-
memory/4900-12-0x00007FF866E20000-0x00007FF8678E1000-memory.dmpFilesize
10.8MB
-
memory/4900-14-0x00007FF866E20000-0x00007FF8678E1000-memory.dmpFilesize
10.8MB