Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
02/08/2024, 22:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://143.244.153.54/
Resource
win10-20240611-en
General
-
Target
http://143.244.153.54/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133671108894274471" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 4852 chrome.exe 4852 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2536 chrome.exe 2536 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeCreatePagefilePrivilege 2536 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 4832 2536 chrome.exe 71 PID 2536 wrote to memory of 4832 2536 chrome.exe 71 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 2064 2536 chrome.exe 73 PID 2536 wrote to memory of 5084 2536 chrome.exe 74 PID 2536 wrote to memory of 5084 2536 chrome.exe 74 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75 PID 2536 wrote to memory of 1828 2536 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://143.244.153.54/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9298f9758,0x7ff9298f9768,0x7ff9298f97782⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:22⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:82⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:82⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2732 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:12⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2768 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:12⤵PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:82⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4308 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:82⤵PID:4620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:82⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:82⤵PID:3392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:82⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD50a789e02996e88503a38d3debd5d0568
SHA1e1f019e02a50eaf86e712688d9ab002b0f45cf3c
SHA256994e632f8171093edc61b2ebb6f6bec634ff18a7556c1d1e3d294bb2ad2aa8b9
SHA5122810cebcb1ac2b5531aa2ddfe05bf9df96df6ddbc5e7664008850a871f87c92b22b194895f585d8077a1b0ab03514a1e086ede69937dfc4ec675b389a7003427
-
Filesize
5KB
MD5c4bfe19aae7c9eee5507887a407ce234
SHA10fa81db7913333e27f7cdd4d011d27bf89741749
SHA256037d1cf5b658789d0477dca764ed5d48943b0cc3f60a0e0e12c22dea5709bc75
SHA51287f51fba0b924e147082aa2b67d5ba67ac96a091a805ea10a5528c10df605c47662c569f7cc6ee8e628e119b80bed45f3bd711c23b78a37364981df3d6b5054a
-
Filesize
6KB
MD520bc65c8739fdd27e960a0556b0560f6
SHA1256d714abf4e619d11f38a9120e2947c266954e1
SHA25675d5eee74ec2c7fa6f357f06e8aa3ad00c55e1b9c7e2473dd2d2bc9fad1f8fa2
SHA5121fe2c7d8a207c43056f710b0b26f87cd17f618ad5a96f765b52517142483ed736ea28b5385e42509c28c753316254c5a6fbbdf0dfeb26179580927712daab0cf
-
Filesize
150KB
MD5adaa84684712573d124077fddfc2e302
SHA10eb339d70e95dcc49f3b756808b7bcb9f0363325
SHA2567a54e0b593ab62ae1c25763513196f9021f612c7ca4877f1887e9e8e0e5e6ede
SHA5120e3d4078146f289c69b2c4b3223d6ce535fff984ffd27c0e0cc475b1fb8e9943525ba99fcc32c82b930c43a3feb28ac67abfedb45536d9f0ebb585e0cf1d14b7
-
Filesize
167KB
MD54c0e61f708bd4525882b2db339addb8e
SHA145b57e9faf913eafe526c55192db7875027bf471
SHA2561415c2849027ba98dbe6815e28920c1e1463b386dc19624364bcf5f0f96fcbdc
SHA512d29d6406e6c6e0ee705e1aa38ac4936143366b15ca3d4a5d90aca8aa801d0c009bb618f820398eafb475d1a43e82e4f982cc185545486fbb50088e70ea4db8d7
-
Filesize
150KB
MD57401ef3f80676a784768a1fc421dc5a7
SHA1b69f80f2d4c43114dcbba984b320aba81da0a58c
SHA256a3cf62d819b966dcfe083a95914fa8e838ad9b27ab3a1e1c79c40e758ef3d1f3
SHA512b3e5ff505513e92a5b31697a3aacb360739b4240ce5cb2f602e3341886f4fae5263c3379187259ddd7a0cd5b248857530e7e7ff5c79d1de3ee3a45d680290931
-
Filesize
150KB
MD5cfa32abab2e6796015733b28abe6ed61
SHA1d2ac8fa051bc3c92d720fd7e770ecb0828c64e66
SHA256690e61630c893685abac1f692696996fdd8ec37cd39665c219d12c829944d1a4
SHA51294f028fa4b85995f1df368d6c244f48e12931e51bfbde84629fd42defe1fd51022e6a55a86c3fb6cf0a29c2d8749c02bcdb7d529d21bc9910e0f32e48cb4bc32
-
Filesize
93KB
MD589b972ac762fc8e629dbd4c229b8ec47
SHA1d3cec2f93e388b84f57ca961898595ee4ee25f0c
SHA25603fe411bbf8aa00219a3753487941935f686b9f04ea15d5abd162be6648000d9
SHA51270fed7e9bf6bc3cfbead15189799319958c483d0bab489e25447f3b1546ad961f9c79eb7bcdaa2c7c48d7c20ef066cf83b4a349f26a756cabd75caab45f339ca
-
Filesize
91KB
MD520f106a13a8ba1973f0db56590eb4532
SHA153c763ab8e19e2d7c0f24ff2153b274667b75669
SHA2565e24d0a54b7101298da9931d8ba2157946a4964618844ca7505c262776ced83a
SHA512245b4718ec36a48bfb38c60da4d96d3c9d44887b0bf8bc6ccb64399bb9a6a6084ff9ca6b14bcfc471de9f194b7d8cd3a30639818588a703700044d6a31812687
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd