Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2024 20:37
Static task
static1
Behavioral task
behavioral1
Sample
1282439258212139042.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1282439258212139042.html
Resource
win10v2004-20240802-en
General
-
Target
1282439258212139042.html
-
Size
4KB
-
MD5
7a710a287589d67de260bb6d4bd8e6fe
-
SHA1
4d84096bbfe3fe78c02b5390d33808685aab74d1
-
SHA256
2d85776928fd6fd91ec3215832cb320eb16d0e7af76213d6965988446ad1d19f
-
SHA512
814ea06bbe014c6f8791d895919a6dd45aec68ee1d5b1da72c2db1b53f6340dd3803c383188b2ed0e61d3d3c57765c9e097fd4bd5087b55154f1729dd40e10a5
-
SSDEEP
96:yUpHjOfRr8LoXRe5mvtgCsXe5oEcrh9nx/IJ:ycHURr88coVNynx/0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133703014972535014" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4720 chrome.exe 4720 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4720 chrome.exe 4720 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe Token: SeShutdownPrivilege 4720 chrome.exe Token: SeCreatePagefilePrivilege 4720 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe 4720 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4720 wrote to memory of 3232 4720 chrome.exe 83 PID 4720 wrote to memory of 3232 4720 chrome.exe 83 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 3024 4720 chrome.exe 84 PID 4720 wrote to memory of 1748 4720 chrome.exe 85 PID 4720 wrote to memory of 1748 4720 chrome.exe 85 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86 PID 4720 wrote to memory of 2432 4720 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1282439258212139042.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7791cc40,0x7fff7791cc4c,0x7fff7791cc582⤵PID:3232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,8875994805880671856,10571200684927945355,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1948 /prefetch:22⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1876,i,8875994805880671856,10571200684927945355,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2192 /prefetch:32⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,8875994805880671856,10571200684927945355,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2356 /prefetch:82⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,8875994805880671856,10571200684927945355,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,8875994805880671856,10571200684927945355,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4580,i,8875994805880671856,10571200684927945355,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4592 /prefetch:82⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=728,i,8875994805880671856,10571200684927945355,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4740 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD51060e436c322a7c398b29ed57022dfe7
SHA19d5d6ebfe355225b947e24b994ac6b24de7e58c7
SHA256500cd89ca193876470fb22a40681630d78396e3bc899e20e52e4e580abbf1488
SHA512a75566a32402b5d21fdd55501853e5eba0c13a7a8afd2cfc7a9be3581743d09f1c083c0674c070e1fe39e33b62e1e4a6675ddcc6a0e7fa356709deb2e111c761
-
Filesize
962B
MD5c94d2d8853989bd215c3a25dde850035
SHA15fd1e4ea8413de83bdb5945e3d67bb7c974e5496
SHA2562c843fa77f71874c8ecc5c6963ccaf6a78da7dfc7a48010fa18bc23347de6656
SHA512e86281ed0e3bf35ea8c4e86ac229bbb2fc1072956a09a6fb78dae6cbb167ad9811ee5d8a1d9071f1c5f813336ebda2a98282532daf02ae9043374f5cc79d49b7
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5e0fa469aa2050e8b0646871e281d59e6
SHA1e503009204db87b41b8412e2c4714be42ecd668a
SHA256294ac38f88c470a666e6453e1143c476023ae7642561df6f85b6092967ac3137
SHA512c1573bb6fcb342c88950e04be30ffe3be25c6a0c5e64243ac1d6d0246cb2916bd0f4c25ac4dff4254e12915a8fc58bd2eb0da051b7c18621b86fc1f21589459b
-
Filesize
9KB
MD551ed1a84e1ae3fd9fa8889626fdea6c6
SHA141b72cb124c8166c01b7713348c82a892b2cf1b5
SHA256199d5b34ff855a2bc1cb1bcb743b85d3d9891b429c4083f37b47cc897e3e4419
SHA512b25b78b65bed2932b146f98ac3ca80fe52cbaeff2331f826633fdf2bb3d60fff62936129a26d11a9a30fd80dbda5130214a7a5548a34f37f4cac24f3c079cd24
-
Filesize
9KB
MD5a25d4a0afb362ee0f86688812c2b723a
SHA143d5774543ed3fd9c688c50a2efa864fca057633
SHA2560b3f116c3e694c0931b955265bd6e5962dfa0cf65ee797e8bfd5f28fcd3d7d03
SHA51282710c2290ac0d3ac5e1c9b0c226802c1cc162e600cc1035ec122e3911af5c3f7a9bb891ea7c1df2c48647f280efbcbc55540e28c74b58a2889d06a56ac2cf0c
-
Filesize
9KB
MD520e1f21b85cdca80b535b21ed7de8284
SHA19b890ddf672b0a678bbf66ecf37564b6df5f379f
SHA256a82738d32ee15791382b8e3d446aa7de703b109e888a68935762033d26b9c573
SHA512c5c436e872946bd57c0171571577865c558f26182713b5c1964101ca16cd06b2c11926601c768946d45c36be50d3ad9b76b6b47cfd97cbf8182faba078c29f10
-
Filesize
9KB
MD5a515a7b30fb56ab3e154f10466ab1a8d
SHA1315a10e142560a66576172dc1c55437606d25bbe
SHA256f4b41ec34e7526d0d6e419d2f20b37fed1d5d83f544f6b735964c560123229c8
SHA512fd468e0e3ed98bfc5d772a09272529fb100e858ffcff80c88a551ed9ba3f9cbab345a00bf0e32b6be220f8f2113707261aae64b60c0f78d5a08eeef55327c149
-
Filesize
9KB
MD515192e32cba1650e59ca86c53c871898
SHA1703f457d48f032f420b469657cbfb6181035139e
SHA25690dcc6228f4964218de33f9ecea4ae6d21322661698a80f14e7765892c2b83e4
SHA512ad6e970b500723c20f09cf10c2289b0b75d2964515785aa0939ea762dfbf3b47a7a98078084b6ee0bae0cc4380d9b76cd1f7fae289b71625f75b7b58ca0d44f6
-
Filesize
99KB
MD547fb8121d427949ea996e1ba82068a8c
SHA19b546a43b059f3d4760c16fceffa1d45a82c9811
SHA25656d3882d8dbfe0108ce4426698ff9dcc8029e31f4fbf785210807801358c401a
SHA512fd2e0a24a6d8c48b2995a3be93e81964799bb0c848153d525c47e4baf606d0055b88ccfcf2c23871c7a25ccc8cef1e88d44424b4de16052631ecc649d66994a2
-
Filesize
99KB
MD56942a3d1a5dd48e40dc29208c3e5a5ba
SHA1ac1f6c4992f58bed300df28af1ab396edf7a2b9d
SHA256c56cabc9e2d106a7f3b2a09659eae6e38d40722e3d8116efee18e5915d950268
SHA512519e6708bf7c044d417f8c58109a9f48a6b360fdb52ecbf0b534dc0fcf9333e6d3cee2f3dd4bb27e371d39f8ed0cfc2823424e72af0474a96fde1891c683d89b