Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2024 20:18
Static task
static1
Behavioral task
behavioral1
Sample
38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521.html
Resource
win10v2004-20241007-en
General
-
Target
38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521.html
-
Size
612B
-
MD5
e3eb0a1df437f3f97a64aca5952c8ea0
-
SHA1
7dd71afcfb14e105e80b0c0d7fce370a28a41f0a
-
SHA256
38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
-
SHA512
43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
chrome.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
chrome.exechrome.exepid Process 5100 chrome.exe 5100 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid Process 5100 chrome.exe 5100 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid Process Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe Token: SeShutdownPrivilege 5100 chrome.exe Token: SeCreatePagefilePrivilege 5100 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid Process 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid Process 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe 5100 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid Process procid_target PID 5100 wrote to memory of 384 5100 chrome.exe 83 PID 5100 wrote to memory of 384 5100 chrome.exe 83 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 2252 5100 chrome.exe 84 PID 5100 wrote to memory of 4516 5100 chrome.exe 85 PID 5100 wrote to memory of 4516 5100 chrome.exe 85 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86 PID 5100 wrote to memory of 4600 5100 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffeba49cc40,0x7ffeba49cc4c,0x7ffeba49cc582⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1972,i,12753405979704766810,13675795068789680360,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1968 /prefetch:22⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1860,i,12753405979704766810,13675795068789680360,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2024 /prefetch:32⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,12753405979704766810,13675795068789680360,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2296 /prefetch:82⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,12753405979704766810,13675795068789680360,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,12753405979704766810,13675795068789680360,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4328,i,12753405979704766810,13675795068789680360,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4624 /prefetch:82⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4784,i,12753405979704766810,13675795068789680360,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=728 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2696
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD56ecfbd8255cbd77a2ef3625cefb68f1d
SHA1f363f6345fe7a38e18158a1e254975ddb0893c96
SHA2568eeea7af5e30dded96ee8d725d2e0468a80630f940f15cd21fbec9dfc4c25035
SHA512a65086c5b29be0608befdbe803e76513176152f413870bec54dd8eafa1b700eff08ef163f852f01ed62a16d892e47b1c22ab54d80fb5970d91ef4faef8411e8a
-
Filesize
8KB
MD5428077ebb769951bc320afcabe85e453
SHA1af93c068eae19052a6c57b7643393e1ef12ae633
SHA256db10899120c4503ef28f06e0c7b42afa70a43cdc0f20134a08ca97aafdaad3f8
SHA5129bbf8cecc02065b2d97270b5e582aafe1d64ee6765333dc06abce5c27e42f4d07dda668f878764a780bc9647b9da156f0430239ccd6276d223699280596dc3c2
-
Filesize
7KB
MD52a274b848ffa23d27d490cc619e1a275
SHA1f1319b1f7b0c2f2d3b1146b85d94bce002ac1a1b
SHA2568ae50385c3a86dc95f7042150addcdaced9134100e10e4ef68407ac4cf388031
SHA512a603a5ae95111564dc8b5e602adab5f7b339a43642faf54858071235800ad6bb88c1bda2543fc188e8e063e8ac6f977c582fba1de55af2761f04f7ef7f5d3d15
-
Filesize
8KB
MD5dc38f2ddf83bd7c339cbab08dd443f65
SHA1cc240ecb87b5156c9dedd7a34d41b4586584b40c
SHA25680f1127ceede71295f1ddc2c0e8960b30b911ad4ca4788fa787d1cf6fa9418fb
SHA512614e8babc4bdac35d234006277dcc8ddbbf386ccccba917a32827192318a8dbfb808b24a93106ba5878038367b70df3b3d82b18557ecb945800a5099e00d8e57
-
Filesize
8KB
MD5a01dd7bda56fe84e0cf252a81a611d27
SHA18820d4134124380bfec5cede80c11b46f6a9ea11
SHA256aab877cb08e97c4a9e9ac84006680003bd5fdcb66411da36cecfa3024fca86b9
SHA512a812bd458130171cd0cc227da6268f04d2672ca25024e656a4e0f1e4f1043203f6225a4085374973457c86aa906e91b88c47c57a0220e350803668f27dba9166
-
Filesize
8KB
MD582b22aa855bcaec312d341b9597d5843
SHA12ad98d92898ddc8a6507de042f6d0abf09ca5ede
SHA256ed67bcd36a6950d116cc1d9d52f356add366df6cc36531c3dc92609db37d4595
SHA5120417644f9986351ea31d0f088782cc3d044f06e7daf431a5e60e87b27a633515ffd39606e9da138b3835a55be917303635c90651956fc43a9b49836302f92277
-
Filesize
8KB
MD50f0600b35c4d14914b019f83321776c7
SHA124380ddb5495854409557194b75155436daabf6c
SHA25612751aba6bc56460fecf0cdd6dfdab6a01dc3df8eb04a86af4708ffc445e6cdc
SHA512a55d1249040e461dbb9a1afd8effaeb82d1ec4727ed303dacd62c23abb96197800479dacf2d7a2d4749a39335eee57f23b644845efdd550586980b910491822c
-
Filesize
116KB
MD52e9f63443778ead0b712e45b1e48a65c
SHA1beecbd41634b90f613587a0559feeb622dd656f6
SHA2567e8886aece4a8dbc775f6c394965c8de3320f9694f9882b85e7c1c61f69db9f7
SHA512b86a57dfcd9e8f93f0de75be86f8c6cb5fd2694d18330bd571afdf5e48fbb6def23bc73990a069ede6eb9a2bfea751da49c36f7a3338ab700bc179a5ef5f5395
-
Filesize
116KB
MD5467e9e84d01cbf16f6a4458169a64d7a
SHA130d21481d1e8100d8545b87228b5dd3d43f41124
SHA256aa7b6678deaec5813a9baddf045f107bb07c318c9c7e0db5e504fb296a3b9a6f
SHA51236035159d907d99aec8363406ab4c29980747cc13188ff772316b94537feed46f956701b9586f2c647f675225f91e7dd59957f66ce91527d301a585b53cff8e6
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e