Analysis
- max time kernel
36s - max time network
38s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
17/10/2024, 09:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://business.settingcontactcommunity.com/support/110143680473543
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target https://business.settingcontactcommunity.com/support/110143680473543
- Sample241017-lmgexasble
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133736315450998995" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 4984 5104 chrome.exe 87 PID 5104 wrote to memory of 4984 5104 chrome.exe 87 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 1192 5104 chrome.exe 88 PID 5104 wrote to memory of 3120 5104 chrome.exe 89 PID 5104 wrote to memory of 3120 5104 chrome.exe 89 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90 PID 5104 wrote to memory of 1936 5104 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://business.settingcontactcommunity.com/support/1101436804735431⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe19f3cc40,0x7ffe19f3cc4c,0x7ffe19f3cc582⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=316,i,7448668952048203283,1409587100666771842,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1584 /prefetch:22⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1928,i,7448668952048203283,1409587100666771842,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2108 /prefetch:32⤵PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,7448668952048203283,1409587100666771842,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2272 /prefetch:82⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,7448668952048203283,1409587100666771842,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3124 /prefetch:12⤵PID:4280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,7448668952048203283,1409587100666771842,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3648,i,7448668952048203283,1409587100666771842,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4628 /prefetch:82⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 c63388c634860ee5776e66e84065aea99b34ac823c565d1b98fe1e3c85fbe395
- MD5 c179013cd48af318ee37035feb18137f
- SHA1 5aae7a811168b983674be58c84daa0f96cead887
- SHA512 c5c50afadb6c135e30b2e73603585e00c2584bfba5099b1906f78241fe6461018c53af9a6f5f2968c5bb0871ebf7208883a12b665b22a93f0a1f8de3f286d5c2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 bfbc3ab4b399d285d1ef6f39bfe9dd5cded33a2ed5e0437802c849ba5fad32c5
- MD5 0ec177705afece10b1f4adb0fc81765e
- SHA1 9536f063814b37ad6c1b3e6aff923daf3ce02442
- SHA512 79d01199da4c62f52fb8440ba740692b53bac47a7330ea87d04cb3dab202ec93572700caf1ba9b5cd7a4e8ef610a2f29b8de2755c5ee44dfb3ce55a6a8d15d3a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 8a728eb052dbb123f2597b4d3f24080b9192da862dcac25e1eab345109ffd8c6
- MD5 01fd08d03063392ca9c357f4f41f6ca6
- SHA1 7f04ee6f3cd982dfcf2c534174676c9991b15c64
- SHA512 4548ac3b885ac04c20f19faa71601d2a6312f4d8d1f1bad7b3700df4ffbd490fdd738f5a770c3646acebaf5dc47b72123cb238c92e3fc2e6ac47ddbb25f15901
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 691B
- SHA256 72321ab609b71a6439a832633d28947f6f5e0cebb52546efe7835655cdaabd68
- MD5 72ddabee34d1466942b1f0bfce146fba
- SHA1 2fed3f260a8cb984bba3e774a0117c5b8d2e1067
- SHA512 c2634be0a18e9bd8604d854b3d4f475ccb49d6853ee5432bcc2ab1dfcf103d3d608f132a4d8d541ffb45c9b34d8e306aa6fef928abd919f9d540a13acc3e550f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 9f15f049abfeaa2aa521af097bd7ec8ce20e062ce91ddd99a91b99ce5ad074f4
- MD5 77b8c456a3716ac0f3ec2f935fd40f61
- SHA1 be29d9ebb9bb4c4d6a648ed7113596f6f4ef8438
- SHA512 2bed4f61d60c22e3edab3799b1d412e9ae7670580f929c22d280d24b67afa65b39c7ab7db214c9d260ed98eccc1d0404bcc320300540af9b07984bb3cdeb5ab9
- SSDEEP 192:+vZr4buLBeXwHV+FPWs8kkwy0Po6yIsnVdg4:+vZS5UGesZSY4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 eb7e8fd4ecef214da388f97b6fcfa2b86c957f8ed167de6997b7f588a2b59544
- MD5 ce0b3ab4d7ff91faeba091e4de093010
- SHA1 1740eeada2a725bdee7fc6729b125b0d9731590d
- SHA512 7d14068d9238421fa8e7418f5b26e0dc61a97e9841a95b7fff086b7652c1ad3b732734f9b936d71b45d9c59391dfa75f1dd975d83661d6292a2187958aa14575
- SSDEEP 192:+vZr4buLOeXwHV+FANkBkkwy0Po6yIsnVdg4:+vZSsUG2kuSY4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 f1a53a8d1fc6263e28c4f44a44fa38f999829d7dd85e99d8f3de549a96b8e961
- MD5 90e2e15cc1bcbde9a5a0e4c1ba082f24
- SHA1 ce0bd7b0bcc033d6f56f6d3f42d195606525b9a6
- SHA512 29f7461a3ad1e7e81516e77717dd401ae7045114f374729adebf0c791843664dd8b5c1b567a85a72dcf7cc40ac056c50d8a929f7d0206c0f71e4e33b13db0dcc
- SSDEEP 3072:+cZ6UZsu46J8ixse6HWNMk6YILigpcehoroaeS:+NUZt46Jlxse6HWNj6YHgta9eS
- MD5 SHA1 SHA512 SSDEEP