Analysis
-
max time kernel
1800s -
max time network
1143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 12:49
Static task
static1
Behavioral task
behavioral1
Sample
196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html
Resource
win10v2004-20240802-en
General
-
Target
196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html
-
Size
3KB
-
MD5
ace67f099683c4360f442c58da66aeba
-
SHA1
2b90f1398b79331e8f853ddb004dcc87a1daf540
-
SHA256
196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005
-
SHA512
02e2465e10ee581b04896dd77ee906542786b7662071befa9b6c07fca00862be063516030045fb29fdec1a68108aaf93cc30db24cd329776b1d316c9d7ca7073
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133688911644087028" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1684 chrome.exe 1684 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1684 chrome.exe 1684 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2612 1684 chrome.exe 84 PID 1684 wrote to memory of 2612 1684 chrome.exe 84 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3608 1684 chrome.exe 85 PID 1684 wrote to memory of 3928 1684 chrome.exe 86 PID 1684 wrote to memory of 3928 1684 chrome.exe 86 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87 PID 1684 wrote to memory of 1260 1684 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ff90994cc40,0x7ff90994cc4c,0x7ff90994cc582⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1920 /prefetch:22⤵PID:3608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2168,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2180 /prefetch:32⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2444 /prefetch:82⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:1388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4600,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4608 /prefetch:82⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5d5cfd7c039be01bada20508fdd606e34
SHA1718b1d063ba42188eeedfd5cc15d8352cca39902
SHA256ef13fccffd43722f4291344043d1d60baab0f250645724cf361a6f641fd60de9
SHA5126f65083cd7122e23fdc5874c8f31b3132f4c61471d3d466a7020680e8391fd084c83beab23c7c22257f10efc5f1fa1bd5661531f35298bf3b9988b34cb495adc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4643944e-e1e4-4fc0-908d-3a9520a7bb56.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5fa9d94c0de6b20cca9fabecfa1c12160
SHA154f4802d59db530b7b2bd4741037299397b821ad
SHA25611eac5ba887d532a472eda5027eb37df8b4f1ea259069b381294aaa3dfcf41db
SHA5124cd191d0e56d19d96d1039ec654835492c24d48138f315d8ae06023d2dee2cd8e7607bc5f65c309eee1281878109440db589f3c17d6d22fb338024c2fea0168c
-
Filesize
691B
MD5a177656e078815dd336434c73a324823
SHA12626b60caa64427ca31155d4bd6316743babe51c
SHA256574e76ddedf5d54bb0192d426b4eeb85c091bba030a5d552ffd2ef74c1f08acc
SHA5124f5ebc50307f36a8a60957de32411809a964a968d0e7de2b30980fd2e530db5aea09e64f8df1dd5ea2a9b3c2cd2909e56016778dc40ad13a4648254b4bbf8e7d
-
Filesize
9KB
MD50fd6018416f4ea953da8b5df39a6772b
SHA1e9d5d4d6e01cb3a855b26c4047ae8c1ce31bbf61
SHA256ab15da05302f403d1b97a7c224a03b13f5540e411ecbd0d5fe689c938f6b466f
SHA512a71b027193329ff203d6413908e4c3c4476935cbb44b381c414a9cae3842b44ba29f4dcc307f90b2f33c75ddfea2d25ffbf92e4dfa147b4007e989f58d2e47b3
-
Filesize
8KB
MD5eca4e43d0291d6cbc4f33a9f62c72ee2
SHA199956e0b065206369b748b957387f79d13bfcc2b
SHA2564ee2015d1f130f0276982e23aed5fd81ea9bad2e69061466783363abb1be83a6
SHA5121402e656dd0c074f31a3eac84dcde5a8da78e46376afd8cb5d1b8a4667642e6a82284144b2a98ba01c841fffcacd3cc26ae540d896aa9a36e555c33ab267b975
-
Filesize
8KB
MD5d4895a5ecff3c35c4f9524295f0a704e
SHA1681c7dcfbbfb8f026b0bdde752cd38d1f89d7cd9
SHA256e1e07833d6c3296f7582383cbe3e3e1e03bdc552854ca1d1870430fea4d1f7da
SHA5128822746d6cf6f19daf280124e6e213a1e4fbf0535540304b470c5c724a0264837bd98ed3c80f707280ea9cfb7d9cf56f6236e085d8f188370492c9ffdd4150a1
-
Filesize
9KB
MD5ce7da4abff40e6429f59608017b69aa8
SHA165f400c4b8e7dc88611cbf662c1d623dd3c428ae
SHA2561a955941b9f70f2dc233e3df4d6ed0ab14580fad112dcab4d9af585ce983521c
SHA5120e9fc657ba7fee270756ecf0867033624d538c28f3c83331acac6214c8962ccdb9c7fdc5c449699d67462db9a39bf2f52ed13cdef20e5749ebf0dc1ae544bda4
-
Filesize
99KB
MD514e278dc1a0c3405f3a854b4ce7830a7
SHA11186ce1d47c3d74f2afea10531a2611fb7db5198
SHA2564cee4325e06b74c990cb9c5a12a272349fb512ce0452c8f586e0535987a99398
SHA512fc4f2b5b6f84c6babc0bdc4e88e893e119c75ba3b5c395e3dc864f981e3a5086c93df17503e788ee84a867a3027cb9ddfb14116672b483bbd41dab4f90646abb
-
Filesize
99KB
MD5fa4bd5d8221e211be7d2ff7e5381faf0
SHA18c0a4f0c4c1b46ddbd15441348e50dcbb620c222
SHA2562f2545f0b6ef280f7ed8d96078bd03b0b5bb284752207dcea560ef8d181fc571
SHA5126fa16956f68a57e0251e4005f59e7669d112c3e7a905107c86126895229399c69811c4e9dc63de485e52342e01bf340cac50f75484756fde7011b1c0d71a50d7
-
Filesize
99KB
MD51e83dee435334b8c35a0602319cfdbd2
SHA13cdfc0843cb1f704d11d046758eb95541e0f4f40
SHA256c510ea6f041c5974bb110749a68dd641d1cb6cf27d7bdd225a429ba7dccd98a1
SHA51274c33315950b2d8df5170b9c86720e5ad4fd1365064bb27bcc6cb9221d906f7e7a2a7736e67b17b02f386fc7feaac29dfca23812ca614f3f5fccb61e667a63a9
-
Filesize
264KB
MD559708af2851eea33b28b89996cf97f4f
SHA137ed45df69313cf33882440b8dd90472309071bd
SHA2566ec9b0be0d24e9022a9f7f4d86032d08f355faa1ff0ba8142248c851797fbf90
SHA512a4e3fc137c74c8fbaf6fda567b868598a091f9ab6344444c49e97b73402a0bcb7d35b28bd7326c586ba9e4a82258bacbe6c4f64bfbea59c699539c38d96a88a9