Analysis
-
max time kernel
67s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 15:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://hiringellc.com
Resource
win10v2004-20240802-en
General
-
Target
http://hiringellc.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133676042523843451" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4220 chrome.exe 4220 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4220 wrote to memory of 1780 4220 chrome.exe 83 PID 4220 wrote to memory of 1780 4220 chrome.exe 83 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 4700 4220 chrome.exe 84 PID 4220 wrote to memory of 1584 4220 chrome.exe 85 PID 4220 wrote to memory of 1584 4220 chrome.exe 85 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86 PID 4220 wrote to memory of 3620 4220 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://hiringellc.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd8d44cc40,0x7ffd8d44cc4c,0x7ffd8d44cc582⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,11850666358264579840,1539344340973415314,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1832 /prefetch:22⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,11850666358264579840,1539344340973415314,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2160 /prefetch:32⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,11850666358264579840,1539344340973415314,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2388 /prefetch:82⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,11850666358264579840,1539344340973415314,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3068 /prefetch:12⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,11850666358264579840,1539344340973415314,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4104,i,11850666358264579840,1539344340973415314,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4336 /prefetch:12⤵PID:3792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3380,i,11850666358264579840,1539344340973415314,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4644 /prefetch:82⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4644,i,11850666358264579840,1539344340973415314,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4648 /prefetch:12⤵PID:3312
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600B
MD597e9e734bffc4271ce8ddce0e834d281
SHA1c8f74c1e6a2ee24a9a5c01d6848901b05ad43315
SHA256901c2677363de4a628573d25795ffd1693d08a2414b714d8979d0620d0dc48f5
SHA51215ca81d1be8465a117eac219b8ef107ed29fe12fe09f887177fc6185c03fac16b14265017a36a3de272ef601c144b0b32a6933f4a11cf940e5883fb15a0086b5
-
Filesize
1KB
MD5f84ff4c41b974d8518e6bd6bb82cd5af
SHA122b154e2af91e5259112df943b737ea35faa4594
SHA25642ecfae7ab707921ccf5373548459c5d28e2cd7972f12c27c396cdb753b527dc
SHA5121f681812870015227f5b4dd2feb15ecd2323df3557832422545b034914e64de3a9437c03b37ee0b18f845402aa522eb702cc33cbca13bdcdc0e75a52a42ad8c4
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD52cf2beb7d68c579b11e51851d25215a4
SHA113b5142b054f57785debdfb81268813da1b21988
SHA2563e6608cb37551547ce56f790bb2163cd2ad8938cee3703552801364fc6472b1f
SHA512d7480ef9a15e82005621d5829982ea273f9e8cbbda9f5ff96e5803b9b758a7d0da1a5b71d70e324bf2e5f7e011cdcb74f23dbbc2cf16ab2b4ab2fbc6dc5f38f0
-
Filesize
524B
MD55f5e4de71b9e20e851d2e0f5df4a5cfa
SHA1f83acbbcfe44f7ee822d9d7cfe6aec68f2235eeb
SHA256da9321e9298aec9f602dbc2d351799381f602267879f9f38644dbd0308e3b380
SHA512bfe01812b865e90934fcbe281de1c1143dc9847e2dfaf0639c02517413dafbecb39f4e3a63e8ec0e0a2126417c9f6dfad3d507b8d764bc10c1cdc4ce326ff8dd
-
Filesize
8KB
MD59a4d3b840ee9341e6273bd5e6679c2c3
SHA11ab587a98b677fd02f8dcfe614e7806641ed635c
SHA256e633d5716b8ca2a447723f182656d99c9ddfbfa0faef85328c7c00001d50cdb3
SHA51271510b13c2e480e098b1a9a9d4efd555165f33467f565463df19b8c27dead9e9ad691f316b7addf1c80f8b2117c960b2ea4bcb2cd10e6035ea9e346e2da5d907
-
Filesize
8KB
MD5141dc12b0c14b8c5c7ed0e3a7f64ff1f
SHA1d3e211e44ba0142e5fdb25c5627918f28cdc3b54
SHA256106730c936647117c9a2f247d78c4fda36e96c7d42f5621e71b67524e9850e7d
SHA5123af76c2e34a84576961e453a8c7af8b81cfa5ccca783a6c7b0904c2bf72531d6fad37f687fbe4654505c619673d6c7d363dd52c811acdbb38b2929b73776d14f
-
Filesize
9KB
MD5402301006127d211977eb4f2669f69aa
SHA1cdb98b506079bb5f7beb77d85682916f68a1db9d
SHA2560f153dedaf66c783470c28c0c655a75360e0f64b4518ddd33fb39895754d6ec5
SHA512bb6b2c44820333a05d16d62843baa0af02e795c12fa6914a161246c66a104ef8f8f69f26412891c064a571e281c3f6b46efa07c1649f00edaf014d85f4017034
-
Filesize
8KB
MD5fdd9a9a78103b40dee5aa111d6f8877f
SHA1bf3bb3973062edb931ba07f19823c60679be59b6
SHA2561c2e17043523e1a80cb7ba6acd47525aa90e4534e08519fc130154c61d55ac52
SHA5124bd59a0911e54f6cbe9ca3f7bdf04d25f03dece95f7387fb97c6d6af3f33259b2f55a8d7001c125c5f1d7c70f6efec2acbaea7d312f8fc8941ce9e01c9015248
-
Filesize
99KB
MD5bf9041ec36de655bb13215a6a87974f7
SHA185f1589c75eb673f671faf05756425cdfdce262c
SHA2562602ab11aee0fdcb6c6413b972f0b3d1aec524db77b90f01633bbbc21f014322
SHA512b4dbf07116b7dc6632fab54776631efe55da2219e54a7b54c901d17ac7da2460caae031485df79cea7d0b8ca2ac73ae2c83bbd81ba117457734decce3f7d7f65
-
Filesize
99KB
MD5deef2f66427499ed926102b3040cb38f
SHA134c834ab5c91e83a9f5ae86f93db26f4e80dbb1e
SHA256aa0bb451c2d0ba8e128443cb5e87c778c5eadc6a68a465c74bb7729ece3608dd
SHA51219034a6b0f138c4a972370ca13d70a60a87d5d8daf1fefaa15750b79696310b4a501762de824967a5223a4b3b66612ce2b9b54e05a8265fa213e3b44fb4fd06b
-
Filesize
99KB
MD510cbf076c361852b34fe310ec2956dc2
SHA1abdcfca297261f0f64072e4304b08cc894b7a392
SHA256bba1be354854496cd9c726bef0b1c73209ab66c1d079645b5046fecee96e6ebf
SHA5127c9ee3694ae39f3264ed072368980b870c9246291498bef48eafd93f0abd75c48d01b920604d0d5bb9fa5e78b02a616461d1a3d05511d1eb28fa06fe0da683c8