Analysis
-
max time kernel
35s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 23:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/12IDI3ADBRxRTLwx0vj6GU5juR9aZhreX/view
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
300 seconds
General
-
Target
https://drive.google.com/file/d/12IDI3ADBRxRTLwx0vj6GU5juR9aZhreX/view
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 drive.google.com 11 drive.google.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133708319959628939" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{DE070137-3FF4-4117-BDD8-3A3F3A82347E} chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3708 chrome.exe 3708 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe Token: SeShutdownPrivilege 3708 chrome.exe Token: SeCreatePagefilePrivilege 3708 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe 3708 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3708 wrote to memory of 2696 3708 chrome.exe 90 PID 3708 wrote to memory of 2696 3708 chrome.exe 90 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 2976 3708 chrome.exe 92 PID 3708 wrote to memory of 1260 3708 chrome.exe 93 PID 3708 wrote to memory of 1260 3708 chrome.exe 93 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94 PID 3708 wrote to memory of 1304 3708 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/12IDI3ADBRxRTLwx0vj6GU5juR9aZhreX/view1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7a28cc40,0x7ffe7a28cc4c,0x7ffe7a28cc582⤵PID:2696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1900 /prefetch:22⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2036 /prefetch:32⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2392 /prefetch:82⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4468,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4548 /prefetch:12⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4532,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4728 /prefetch:82⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4732,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3672 /prefetch:82⤵
- Modifies registry class
PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5324,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5336 /prefetch:82⤵PID:5228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5544,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:5392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5080,i,847908407104572628,13466352319260899936,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:5408
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:81⤵PID:5132
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD53be65d4a7cf26a49b64163c4ec5fa8e9
SHA1501fa6d158745d72fa499d7646f483505e10f278
SHA25608ab6c36b2ceb124e118da0584e4dee5c7631b743ca5ad6608863741c0710b5a
SHA512b12ac16821e910cd371b098c77a36df90f776b1328e99b45c8bc768a8ffbf67e0974014f6a4101fd3a5301f16bb44767b1afa6acb10a45b90996604dab812376
-
Filesize
384B
MD5e9837fa5407b3b918f5fdfe73c3879cf
SHA121e958b6f6238f17caff786c80b070f0fc2c89f2
SHA256c8055acdaa4969a72ad4e34e95434d69fe2b3a06ff6f684c190dae2d0f7e92b1
SHA5121d6eda6c449e0770935fc9080fdd7dde451a0f4de93e00178b202e56cc51e0673a9f1df50b5e6f4a41cae22f9dfdbc7d2ad22b765d871c059351f04a02bbfdee
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\64d333a0-755c-4038-bb6c-cab17a3913b0.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5a6086d8d4cb562ef1ada3878551d59f2
SHA1ff02549a38ab426f097567720da1a6ef47f3381a
SHA256751657d616050b7cb2a829b5e589edff1e83f40972b74fbbbab42bda16edd79e
SHA5121b23c1d36bbe053b7c6056e6d4eec605a9778e2e67c46b786d6d9bcaf96f64f7536af15a38f01abb01523799424018096aafd956735248668b3b3e84b0648ce4
-
Filesize
9KB
MD57e3b786f5e2e8d0a8cc21887876a0d37
SHA10146bdd7b6f8b33688b779cedb1f4198cb36ad6c
SHA256b5d60bc96416ba5c58fa107c33e900507d690bd4d33fb077b0a7abf6c11dcae6
SHA5121c356caff1b93bbe762e9fa7e0ac45eeb9cc8c8dcf8d7eb2be0c11f24cd30efa2fea98c794d98788cad7f7e1ea222171cb17a2a3885fef3a634e70c0d5d9ebe5
-
Filesize
9KB
MD52b47c7fe6b56594b088b560fe9e19b1f
SHA17649faf4401cd02cd811c53fae63b4abd3ba1b61
SHA256163526d20b2667f41ee8fc37ed5ab1c4568b6e535d324fe6771729a1dd4303cd
SHA5122e2acfd44e17df7e6cd805d0238cf61a120ee067af1d7d0d23c59ee94c22fb6c42fec5428d29f4e4df77e4b4ed3f1ae4a88ea7e6acd2089aca4f1543fc5deaa7
-
Filesize
195KB
MD57c81f5be03fbb86c890c1826f7caa81d
SHA1e06303de594fb25c66b5d25c6b3c6517ec10df92
SHA256c0e6607fb40c351a0fa525076331bf03c5d923c04f208c501ec9642f91ef9f7b
SHA51278c3940eeb9b60d1742d6f96eb7af8798de4fa6e5806140f56fc1dc0441c509f6409686a2b5f156e5ca038849f4f23f2f50fb205405a33c91b08bd6170466b9e