Analysis
-
max time kernel
50s -
max time network
54s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
09/11/2024, 21:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://172.21.124.113:80/
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
https://172.21.124.113:80/
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
https://172.21.124.113:80/
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
https://172.21.124.113:80/
Resource
win11-20241007-en
General
-
Target
https://172.21.124.113:80/
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133756620109763129" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1912 chrome.exe 1912 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 4424 1912 chrome.exe 84 PID 1912 wrote to memory of 4424 1912 chrome.exe 84 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 4052 1912 chrome.exe 85 PID 1912 wrote to memory of 2288 1912 chrome.exe 86 PID 1912 wrote to memory of 2288 1912 chrome.exe 86 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87 PID 1912 wrote to memory of 1204 1912 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://172.21.124.113:80/1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fffc58fcc40,0x7fffc58fcc4c,0x7fffc58fcc582⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1912 /prefetch:22⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2076,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2132 /prefetch:32⤵PID:2288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2296 /prefetch:82⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4616 /prefetch:82⤵PID:5596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4696,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5108 /prefetch:12⤵PID:5392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5096,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:5828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4476,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4808 /prefetch:12⤵PID:5500
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:5148
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0538a447-1e58-4cbe-965c-8f7a487dba68.tmp
Filesize8KB
MD5197b3956d39067e34052a263102bc840
SHA11b83b595ee34b999678c2b9a34ff2db19ca80d83
SHA256ca4a1be79d786a01ab548f9189b0896cee743c290e0b73805fcf9636cba15b43
SHA5120fc9fb4a98826be4da8c9135811b78f4bc61888a15733e0052bb05a09e9032da3047a474e5d38699ea7c04a7dab445159108fa3cf468c9ac644ec84ce83fd65a
-
Filesize
649B
MD5e42cfb8645ccdcd22f0fc73fbff27075
SHA18d81eea92fbe436a28cf1998e4ca883690d7cd21
SHA256957f9f9815b01cee1b37b6ea3628a7651a639d02e8f0f8eebbbbf1467e0d9a89
SHA51279be02015eaadb90f4ebbacfe01bf7c762b85ffca1799cf850552aca7994f04f41cf474a9afdaf0e7ea3c2d042a288cc00359c8879ba5f0d50b39eb049341199
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5b0cca643501ce73a8f36d68a804487a9
SHA19beb382241c5dbeb7ab0605f829eec394ef88505
SHA25614880f2ab9e59e8f0f4160bad8cd3fc461504e23ba2aac1e7ec6868c7a704da6
SHA51278269f862a67b008844a48705edcebd08f509466af410bc47a7c3c18e87d0b42529229827ac2a152f36c38cc90f426ebe38ef97bb6de8126dd4b2fec72878969
-
Filesize
8KB
MD5370976724ee28c990873e31c329b7944
SHA1d7e8f5779c79792eb7c6a6a8061c8acb81b4e884
SHA2560e6c3d7d03afac447af538f08c595823cd14e83649893dfcc8d7a70c23e9fdf1
SHA5120e658b3d9320b01afdf8f7f9d347ba927bf3522ed1fcb451022d7bd6d147a37f24d88898e6251c122fab4a8363508b3aadff08a532f94e270c73e3962a4bc094
-
Filesize
118KB
MD5740520429f2123a85ad20ce4af375799
SHA13f84bfbdffa760cec48efcb077cdece395a54dd4
SHA256cd2fa14d3182a8fa288968401c58400af1208da33246a1124959feb38d16925b
SHA512d1307aca80558701d847d27c9f5139ae0858d7ef6d8407e6fc2cb61aec0d60cb9b4acab465ae2317d354f287bd14bc3a25b83cfb9159f4d74e4e767fe35b1ef6
-
Filesize
118KB
MD59266d1885abf48b5dc689281c96ddd15
SHA1968dabee02e27acdac99f873ea05281d9a50caf4
SHA256e1654d2982480bb655f48321deb0f614d3e1aa04c654db3d10a298868a6598c1
SHA512087edbc138de27eefe10c725ad779d9debcbe59d5ba55c9c22ced5573a7a9ec36be9fef01c1e9d2e9ac4c013f4ff4629d330565d1d768fac7425b7a719b8181e