Analysis
-
max time kernel
24s -
max time network
17s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
build.html
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
build.html
-
Size
2KB
-
MD5
c0d9d9f8b973ad06eead0bd1164a1069
-
SHA1
f838678bf68a3ded61a72172ec1910891ef73ae6
-
SHA256
3f358f085c84d8d51975d3b2c1b6bacf9ee4e000d8595de84e1c3f1ea4da55a4
-
SHA512
b4e74f79171030b43d690a99b081939c8a6e3ca83305128c5fc52a705fc9ffb434bf7b4b78d85d3ca29dde230544ea4a21807e923d873b145265865b698bd8c3
Score
3/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133674951790854594" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2636 chrome.exe 2636 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 4936 2636 chrome.exe 90 PID 2636 wrote to memory of 4936 2636 chrome.exe 90 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 1280 2636 chrome.exe 91 PID 2636 wrote to memory of 2884 2636 chrome.exe 92 PID 2636 wrote to memory of 2884 2636 chrome.exe 92 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93 PID 2636 wrote to memory of 3792 2636 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\build.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd4bb1cc40,0x7ffd4bb1cc4c,0x7ffd4bb1cc582⤵PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2088,i,2429050083461805870,17697787894384247548,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:1280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1804,i,2429050083461805870,17697787894384247548,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2120 /prefetch:32⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,2429050083461805870,17697787894384247548,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2440 /prefetch:82⤵PID:3792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,2429050083461805870,17697787894384247548,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,2429050083461805870,17697787894384247548,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4712,i,2429050083461805870,17697787894384247548,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4892,i,2429050083461805870,17697787894384247548,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3256 /prefetch:82⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:736
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:81⤵PID:1200
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c32c5698bbaafaa56b750fad512fe442
SHA197a59ea7a72c11982c00485537240f2e961ddf72
SHA2560fd6174199b742e4b951e04070e9ef91cee9e9487b4affd334fa180cb0c8bf75
SHA51203e9723beef47eb36f0939290ee840500e47c29fab38a43c31793e94d7dab22c2e8aeb69e9b023507016e69de5c88fccdd5ee667c20e5ace51f756b2fa188680
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD581e95b72a459fa878ae9ad2376ee461a
SHA1bcd96fa613722924dc38f78f7994a1b297567118
SHA25627f3445b63cb5a160ec20d10d7e95c709c9bd515933b548664afd1a59dc009da
SHA512dc4d6bb85ee75d908e26127f1ff344b4cb1417efc4567de51e09f1ecb23109fdfe7a9eb6092d067a4a332bab9576f704ed3e6260b582e8a9120e1fa8166b7879
-
Filesize
8KB
MD56915a24dfe5fe31d8dd15a560c15b810
SHA1e563a136081f6a4111453bf97bb86754390ffd40
SHA256c6d960506c4f7e85d8397914ef8cd6110a71d74defcde581b37149e6de7f1fdc
SHA512444c39cb1e02211a32e26838e1a45fae19b8121cde67214eb454eb170e6286462279d1d8287f70013bb6b301dda0c41101ee38641285cfa745a1e5f06e2ca509
-
Filesize
99KB
MD56880b707966c2f98c7a0d1bda846f967
SHA1458f778ab540bb04c55a373ca40d213c547a4b48
SHA256f33d2a9c56294e98d8ae041c33efde6cdc4a08240cedf5eaf8e2f44eeb073ca0
SHA51227e76a8046fed8a16ae69ee0ea228ba9f764c8f2b18aef44d0389d3f8d4caf5c4d8a67e6b135066da4e684c45901a1ce6bd7ba408968f2f4c40135ced0d0444f