Analysis
-
max time kernel
53s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-es -
resource tags
arch:x64arch:x86image:win10v2004-20241007-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
24-10-2024 16:45
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bafkreich6g4gvvmt6ptvfhtinurr3psg4vkbabnjbytcqsdettuwtf2uni.ipfs.dweb.link/#ZGF2aWRAYnJpYW5kdXJoYW0uY29t
Resource
win10v2004-20241007-es
General
-
Target
https://bafkreich6g4gvvmt6ptvfhtinurr3psg4vkbabnjbytcqsdettuwtf2uni.ipfs.dweb.link/#ZGF2aWRAYnJpYW5kdXJoYW0uY29t
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133742619446113214" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4768 chrome.exe 4768 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 4768 chrome.exe 4768 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4768 wrote to memory of 4944 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4944 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2828 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3448 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3448 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4724 4768 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bafkreich6g4gvvmt6ptvfhtinurr3psg4vkbabnjbytcqsdettuwtf2uni.ipfs.dweb.link/#ZGF2aWRAYnJpYW5kdXJoYW0uY29t1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffd7d6cc40,0x7fffd7d6cc4c,0x7fffd7d6cc582⤵PID:4944
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2096,i,14660433620544157050,17830008810952518524,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1972 /prefetch:22⤵PID:2828
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1884,i,14660433620544157050,17830008810952518524,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2128 /prefetch:32⤵PID:3448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,14660433620544157050,17830008810952518524,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2552 /prefetch:82⤵PID:4724
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,14660433620544157050,17830008810952518524,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:1552
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,14660433620544157050,17830008810952518524,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1856
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,14660433620544157050,17830008810952518524,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4832 /prefetch:82⤵PID:2656
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD55b8deb9b69278a89b113e2f3550e311c
SHA14f2cc534cf70866c672f91c89b7e7d868a2a8571
SHA256ad2659575029835abeced33435c9bb2ea9748df45eb0d6cb967e297830538349
SHA51292fa8f443bc522dfd81001ca42f151465f26cb60a86babc05b0fb569c52ee0199edaf3a92d4d52f3948bfbd433eb7184d0a6bb3f6c02a123c2c8105682283fa3
-
Filesize
120B
MD5ae52755f2f05e57317c33818f78144c8
SHA1779d2a94463b32e61b5d1e6405e32e67ac0b2e28
SHA256daa657c512a1ccde9eab1cf9cb3af68ca516ef84841409e39cfb3b6611a57e0f
SHA512b1f7aae4ab52ac479d3ac59498a8cf6f29f57ae1fbc4a4d41c5e4ab89a940e40ea19bfc6029e8341285de50773bc85d8e15a5b034d19e8301b6cdbb41e96b35f
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD556307853f5eb30bcd72b229a6cb6a2ce
SHA1ea8e6e565e630bad75c6c05c95e5bc2f498765ff
SHA2562c39ebff64227a146d3f923b6196636c1207e709e6b61b80c0840e5278228ca7
SHA512bfdf9df36fd25f2d0a08824f3d87e0f0934cd3e95ceb36e9311004a323360ea774f1407008f70aab863c3e4fbbf160c8d3e6ec3fad33e555304ae1c693a39f4f
-
Filesize
9KB
MD5b6602a25a55ae53f01cff5f85a53e609
SHA14f966dcccb1ca6be63f6ee118756b7897d95a28b
SHA256f67625f5281dc3b1bb9bc053ae26612a42a9603de51992e6bf244accf164cbda
SHA5123a0e3c0a13abcb0357bc87f28a29810bb1cc8a4a363f43fe62c2d903ff4052a5f58153e9643f63e1bd2c3f0077bc806baea0d2408bfb642ef04bedb81f8d9611
-
Filesize
9KB
MD5294c4ac311bb579552daa4684b08b791
SHA12dbd3501f94f8dcf0b90a222445cd204fe72b3ca
SHA25605126304ede31f54535cd63754e7d70a95bdb7a8ea670653480ee466c0e7d6ab
SHA51204f8113ccddbc1a37a1780b0961273aa08e911975cf519b1d4989e67e8437b3f157e7aa53126f6d12efa499927629d571c912e0a6b3560496c7b0d874125a305
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c03aa61b-b507-4c4e-b0cc-fa0e17b89588.tmp
Filesize9KB
MD58fe5ffad97048fe525698d2e7551d7dd
SHA141ae8f38995259a6d9c77fb3dee91277c7658c5f
SHA25607d4f050e7b50cc89f3b3187724826827620b45b4e9f28536662e95f4f5637b4
SHA51235363a0fc70a3a24752c5de139c5daf8bba71721fc4b74d5cc065d3c5d97535ba7f7ce3f1035e8f3f1c32c52b21e0e48ce399508de8d302d9954ad91b679087f
-
Filesize
116KB
MD5a3d245a499b8e8d29aadaab3a358fdfc
SHA14b8d36b1a5c8c163af8bd0bd4a131e01e08f966c
SHA2569a15c1b08543289eda8dc5a71eacc235da97e06ec876d2b39112369fc9ba4032
SHA5126bc3792af17e7d668f4312178cbc95371e1c5b56d0460f91222b50c8480499857dd3a11596497aa2c44ad6aab37e9d34e346f2d78d3a557d4b473141e57e0fe3
-
Filesize
116KB
MD5c5510df405680f7873f659fb1044619e
SHA1b0acfacec0f863c54bfec104bde1667016798e4a
SHA256292d0953cd02d00fbd4597535aa617806a066a38a134310fa6dbe8870c91bd09
SHA51263a63d2e9f393423edb0af64a63be29ecc5529bb4a0cf6d54196fdbb908f5e89856fe73b6f0f663038652b457b02fcfccc334af04a489edcb7ab5be33fe9d6e5
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e