Analysis
-
max time kernel
84s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2024 19:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://messages.alllowers.click/communication.html?now=Ojg2KUg6NllBPUJZTTg2QUU8VkFXODcpSTAnKUk7IllDO1ZUIA==
Resource
win10v2004-20241007-en
General
-
Target
https://messages.alllowers.click/communication.html?now=Ojg2KUg6NllBPUJZTTg2QUU8VkFXODcpSTAnKUk7IllDO1ZUIA==
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133752234458908639" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 3832 chrome.exe 3832 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3832 wrote to memory of 4164 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4164 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 4740 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 1384 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 1384 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe PID 3832 wrote to memory of 3076 3832 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://messages.alllowers.click/communication.html?now=Ojg2KUg6NllBPUJZTTg2QUU8VkFXODcpSTAnKUk7IllDO1ZUIA==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffef755cc40,0x7ffef755cc4c,0x7ffef755cc582⤵PID:4164
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:22⤵PID:4740
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2184 /prefetch:32⤵PID:1384
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2256 /prefetch:82⤵PID:3076
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:3996
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:1072
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4356,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3784 /prefetch:12⤵PID:1412
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4396,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4656 /prefetch:82⤵PID:4384
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:208
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD557859ddc7a953d6cb80a1325ec63cf49
SHA1412235f55c7572fc9f7c016e0cda74a1104841f6
SHA2569307d37112f57e453ad9260d96e5b0a87f8ebed6de3975f1ca2e7eab78f7f06c
SHA512a4c5312acf6079e3bb34d7006728ef646d32d28a340b6bcdd2f2e429420dba42d87395534d27dacf790913e1391197cea470fb673b064cdad647df2db0523d97
-
Filesize
3KB
MD59433fc59bac1ee1d6c076f6c0d759bb2
SHA11837e33dff1737cbb835a3119190963391e0023b
SHA256573edce4678c166ea44b2f1bfea8a73ca0577aaafc5f51f5e55a92c932916cd9
SHA5121377aa692a518f0832f95535e5dbef08dddbdd18668d05235c1e1fa1c59b6d314d75f853b512ce817075850aa7b56550acc4f85b7b4ba61fce6798bb031d5b08
-
Filesize
2KB
MD513a4a83549f366a144a033714770f6f7
SHA1c697a073f04c6cdfb9e36a33eb8f5d9bdb827a45
SHA2563e23a105eb5cc304a014353f38f072601178fad49a6511c68c105ee1710d35dc
SHA5124aa7edd9f6686eb20a3ebb52e1d4b3023bab7b072b7295b1c6f1456a80312ee5c938e3fccad8edbb246c9ee94c7638efe118aece80026414d9179d719bcc1a2a
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5499a1a7f17fd8e73d0866f5f1767d912
SHA11b094eed1e88df4fcef01196c8e0cbc7901309d6
SHA2562121adac47a7e226f96a791d455f8fe4cf14e29f292e5bf336bacaf61e9589d5
SHA5122fdddf8b1a3068fafa14c016023ab871dd9ec5356056d9576a715cd6024fc768577463d21df14eca9dfe164326e6f41918ff538b11d5f3024744ecb4c451eb06
-
Filesize
9KB
MD53489ecbf6bd91337eae89482c6281b63
SHA1b5a7e1b3f6210c51b07ff55b2806de79c266c538
SHA25670fb8dfef83bef684d6da36182193d6beb721a7fd8c3d992bdfc901d8d213440
SHA51213187d1106cfa86dcc726ed1f60022c1d2dcc17a0b9a99608b36709facbcab0edfadd468a78f3fd76287773a10e820ce49f3acc8d737842f6b55ab70fedbd3f3
-
Filesize
9KB
MD5babfe075524d55e1c3729265ba4e4bed
SHA1eef17933a92944660a93de5dfb6e7a59414d4dc6
SHA25685c31e916e368aa532a71ada841ba7af412380e2b6d9d0c0c4b724d6de19e08c
SHA512cfdb283255e5eee9c01f3a4fea67269524559c8ead4b448f3b3c410849ba8df8db1a4b17d43b113d759ebc72b65fe7f7481f5455e9f83fb4c44233d921ab08b2
-
Filesize
116KB
MD51c531b9389653655605834fb9cae0680
SHA10761c2a691fb1b1a2da6501b1c7741a1b9c257ba
SHA256e6f820392ad2495c344f1d0ba51abfb8309785320198828310d2e0866d3ac78a
SHA512329bdbff8b43ddefb378af17fe521c8edffe3c3e929287a4e46c8322038a787c501a2bd907395b2bb19445f89e7d6e28b207dd404e00b03538832ac45ee8676a
-
Filesize
116KB
MD5669bdc4b060a593286ff6c32c006aafb
SHA1f509808fc9cd9cf3aad7fbc1a9771701f3e06582
SHA256af361f50c8555c1ea734c1ae8ccee05b015aef3f6e77aee0ab91101e2bc65a93
SHA512bf04467e0ee22d82b216d208c2fa10d77cb78fa4f572027542734e045e75983082f7da8c969150f8e49240cf1777f17bde72132429e3ca83b78c832597a4c060
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e