Analysis
-
max time kernel
47s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 16:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dizikral.com/
Resource
win10v2004-20240802-en
General
-
Target
https://dizikral.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1728 chrome.exe 1728 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 4848 1728 chrome.exe 82 PID 1728 wrote to memory of 4848 1728 chrome.exe 82 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 4360 1728 chrome.exe 83 PID 1728 wrote to memory of 1176 1728 chrome.exe 84 PID 1728 wrote to memory of 1176 1728 chrome.exe 84 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85 PID 1728 wrote to memory of 4276 1728 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dizikral.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffae215cc40,0x7ffae215cc4c,0x7ffae215cc582⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1916 /prefetch:22⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1636,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2184 /prefetch:32⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:1096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4320 /prefetch:12⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5148,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5164 /prefetch:82⤵PID:448
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360B
MD584735bdcc4afd21e45444c4b0a0db6cb
SHA19509578a838de37c67e0c7e3c611a3bf9ba506d7
SHA25644a53420ab6d552bec0680db7932ec3b9ea58a1f1c6914041cfbf3848819c5fe
SHA512fa468ac79daffaab18f29e0b19309fcf2f3cefeee32fcdb0634125f98e57152e11428d24603407c5157212f5f7ccfd13214997745a38ef827c9a4edb603f425b
-
Filesize
1KB
MD5fffd368e2ad2a9d9c3ddb0248dd35943
SHA1b1d6eeafac88e9ca3abd60a30580acd13085c6f0
SHA2567e381842fe7ac8595aa54167236b10fd49540fc7c8da6263fd665ac7a661a039
SHA5121afe329f4af7615fe6ceac6371c75b3760f4903521ee210e2f0944cbb1bd5a939679ef96b166c914f045dd6bc8b3cf7a92401218cbe754bad25cca37114ace27
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
859B
MD5cff52f8cda4ec0274c2a196bb3cb5a26
SHA1803950d159a170158217f56381e391cd517b8392
SHA25656818ae8e2e42de8962e2e0ad8cd470e611bd3beb7d1f910c42a1c4a7ba94bc5
SHA512a8d2e070803a28233e35eea6d32bfbb210085163bf0d143e4a956d44a6193cb128940b2c657bf08478a897cf446a977494aa12b8d2cb2f43f8b73940c0dc2dde
-
Filesize
8KB
MD58f95ddaa854740a5141ff4d0dd40f3ec
SHA1402807be2c161805051b2e1b5d6918ed9e1fc74a
SHA2561adaa0694ae6686df1a6ce86a00ee70def9111c9ec16507b6acbddf5dd757c42
SHA512c5fbbc3d9743b073f56a5721d60bf6f5f1aad02804be6ae18d9988f6ff77b01eff2fe607372fef241c1a75c72881d6909cb62891fa7c6e77bb292a7ba7d526e5
-
Filesize
8KB
MD5e201adfe38684e5ff846ea4485d7232d
SHA13cfa1f0ddc09a63dd314c215477e6fd0058f8126
SHA256047426e1f85aacaa5f859f46dc1fd7d809b04de7d121f38dec947efaaa1a58c7
SHA5121ab7d54f499711f5c8d83d46febac8ffe79ac53e44a005479eea0388a8f3981f1453f2ae64bb1c8b61889d64edd946ea473a643baf95cc3671149d0bfb4a82c9
-
Filesize
8KB
MD5377653a4be5b23a4fce19787fa59cb65
SHA1f101c7ab27ca0cb9b5482e12b402fb8d4eccb757
SHA256f47a46a80f20e0461edfd04cc70145868ab64a30b61bc48085e772d0e8f6b4af
SHA512987fc58812fdc5faba6768f176249b8f7936a90c530d3d580c6c67e09f39eb9b36a79816967c4c94f8c6c53f1fd5d2275f1ff6c4f8ee375cfc7f37cd9f08f653
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f27eaebe0fb2b2c201f6677a36b13a772e988c4d\07190846-46b0-4247-9f42-12d531088a7c\index-dir\the-real-index
Filesize72B
MD5f23c54300d0c678872f195b62d3acaf1
SHA1e5db8ce0df158131623d4abf75b1533e551303d2
SHA256f015a37a11c6645f030287268b50ec83a68d1fd8efa1269efebbc672d3c24a91
SHA5129f04176a3e62caabe9acf586814fb19d82dd2b927a3ac2a1f25e6f0cdc8ce81a4815984f3a42e1c52d9a4188359efce49a3aed87cee8d88b860314d3c1958a27
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f27eaebe0fb2b2c201f6677a36b13a772e988c4d\07190846-46b0-4247-9f42-12d531088a7c\index-dir\the-real-index~RFe582fe5.TMP
Filesize48B
MD501745b243e5743717248b21b02e4c8e9
SHA1733f7802dc2526e65a0385a2bd65dd594fda532e
SHA256da9583c155b52a1b4b8a206faa4e29bae2ac61c110d3468e17b6f80cf73fdf22
SHA512c69a156be8022bdc95c1a882ef3a4674be98ed252b8d789de49fca2f530e165d915e2ec731a9d0c74e9a20d2265f9880b04f118f6cc3446f1c756f92ca85dbcb
-
Filesize
99KB
MD5d36c51373c019f91b06ca6f9af1541f7
SHA190c7c291322e4a4326c7ad51ee876933413fba14
SHA25685aead68cda9549d5caa7f14a41e51cd4fb3b125210addf3292a973d5bd422a2
SHA5126d3e4402c1f0fb59caa0ce101bda9ec9b091a6a0a6a3c9d484adb77a39414f35cf23128b6579ef22ae2fa98bc364630a852623860162c79c42b6f043a2c6a449
-
Filesize
99KB
MD5f79f3d883dd1cb5d367e8d293711c2c5
SHA1f92387809c3bbb566b23800308d4d03b72642912
SHA2563b9b041f9842bdb557d455bae01dc88def8278c261deb0d50d4e4d9d3c78018c
SHA512b24167603fd9817c339fde419c673662202ba230c96d68bf0dd62d272b15ca08063b98ea1433685ddebebd9897040350d2d162bf7e6b96249999fc66aa47980b