Resubmissions
19/09/2024, 04:11
240919-esae8azgrc 3Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 04:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://jpllogistics.com
Resource
win10v2004-20240802-en
General
-
Target
http://jpllogistics.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133711927151644455" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{BA116532-2E6F-4B18-BCE7-E176C028EE7E} chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4668 chrome.exe 4668 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe Token: SeShutdownPrivilege 4668 chrome.exe Token: SeCreatePagefilePrivilege 4668 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe 4668 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4668 wrote to memory of 828 4668 chrome.exe 83 PID 4668 wrote to memory of 828 4668 chrome.exe 83 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4016 4668 chrome.exe 84 PID 4668 wrote to memory of 4844 4668 chrome.exe 85 PID 4668 wrote to memory of 4844 4668 chrome.exe 85 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86 PID 4668 wrote to memory of 4612 4668 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://jpllogistics.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff98354cc40,0x7ff98354cc4c,0x7ff98354cc582⤵PID:828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1816 /prefetch:22⤵PID:4016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2172 /prefetch:32⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2436 /prefetch:82⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3060 /prefetch:12⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3064,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3096 /prefetch:12⤵PID:1700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3688,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4472 /prefetch:12⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4660,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:1832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3300,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4728 /prefetch:82⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3328,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4824 /prefetch:82⤵
- Modifies registry class
PID:512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5012,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5024 /prefetch:82⤵PID:516
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD5b71107f83f15ef8dc711a553dceb60bf
SHA10fac2b7dd54e98a01244727ffcd2f5a7c801ef99
SHA256622329c4f7600baa53ad085f4f14ec45c180007f2df3cc19cff739141e7389d1
SHA512d09a733901e289214484075d7df4cceb042a3f4c5c29a26672bf53ff228282e86e07d9fe77d584e300caeedec836147bd3cf17cbdd3e042c76258ed8c75f6600
-
Filesize
649B
MD557466031453016041c89dd7b37c9821e
SHA11a99690b1f95efbda0e8dfc8442a5516a38aa000
SHA2562ebde8c1065423f4dcb688e6a8137f0045613c885ddc4a4e5084465525aa27fa
SHA5126ed3e6dbb696912cac12bb6252523a0687772a766d085f036a18bec79cd6c764241fbd247a675583f8222fe1c04ec2fa1857f3abe6bcce5cf326207f64489330
-
Filesize
1008B
MD5a5211c747f2559dcaee0dde0023c12c0
SHA186dc31dc9a937f8f94fb43c440d37a1f20a706f9
SHA2564cc7f43f4a82a9f8c9cd5abb868551a0ce5bf0bec5415509fbf6e57894198532
SHA51297698b2bdbe83ac510a140768d900279225f8603ae16461fa5d8071606e67a1ea608a47a7c1c491ec93c50fe4bd06fab74094329093bffae7191bb86c093faa5
-
Filesize
1KB
MD5f2113a7132e4f7880735bc5b6cc80428
SHA1f0237c5962e82f2a8c3220f23907363c6b2f4de5
SHA2564d58033c5781781021eaf00c9cafc0965bc06817e81469dc064461ab18acc696
SHA5123b50a43402fdbed7739d9e9b0897846acc610fd67765e95d5d289f80fedf61c31e2e9f6a7fb220c634218ba0e41f73cfa109626c4334b39777d0b8859bb32d66
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
692B
MD54ea790df98b81ad069e543a4c3f2a4fb
SHA1910dcf4a38565e31b18332739aace168e3ac92b2
SHA25685902ce3ade3f726e76388a7691512621df0a506d32a36838cd55a9a05b5d8f3
SHA512cab459dcf2ad62742428ac12b244efbbabb1d0d1b75fa173596221589a34d31fe53f4fe4f07895c4e79da03a665f2772f8cb20285ecb9ff3bef6bf29f49d92c6
-
Filesize
9KB
MD526fad762cc0d41390bc5164c43096092
SHA128fe51878433eab9ccbde8f6cd3ed3df339d4511
SHA25696ccbabced5402570de9b836998e536bf6829fb083cf7df23b6ff8f4e71efd1a
SHA512ab9d1d2db0a795b01b9ecdd2c32a61725fc24da272f17aff7f6636a00df4d3150800de8ebc5d3300a5c550e0c93967007bed6f695f77a17193393033f4499e76
-
Filesize
9KB
MD594a47adc244dd08fb5db4c8a42b5e4c0
SHA1fe407ab86ee300e03c120fb07c1df927620d6f98
SHA256b5274f5c37786abab37b5184ead2abbac5ec68194809b66e640a32f09a70b3ed
SHA512fda1b5542c88bcafbacfb420afeb27fbbce6546923de5a46fa1d45e7c231b90159ccfee011dd731e47344be837d5a5d4f810ca80a370ac823a365d02f08fcd97
-
Filesize
82B
MD5e1577093727e92f29011cab02c3da7e1
SHA18f8c333f87ac7d4cd6dc2be2fe4837aa51ca1c59
SHA256c37b51e2782433ee2cc0fa006b98a58eaba954f7627761df6ca36ce1fdf6bbd8
SHA51267f6bc700785fe5cccb429d566e9576dfd0a1049273dc4a3316c510f84816eaca91c330ff251f63b543078bb992478b3d82a26f929e4fff79ed60d977d2cbbae
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe57d32e.TMP
Filesize146B
MD52e98a65d9e9ead58b5b1ecfc628575e0
SHA187212d8679260cbc6b9f29fffdbaf2e69d43f70b
SHA2568ea94cbdcaae22cb989015c6e7649779136909c2050631cb4141971e46ea97de
SHA5123b90f68456082b7d66f2cb6dd94e05070e86da32f08ee7bcb3a149b0eaf5bb54a197e8c51b4061fc4e9b19cf20d8a82ed58f0632d11ee7535fb46c508e3d0277