Analysis
-
max time kernel
27s -
max time network
23s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 11:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://loackers.com
Resource
win10v2004-20241007-en
General
-
Target
http://loackers.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133766613253234852" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1520 chrome.exe 1520 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe Token: SeShutdownPrivilege 1520 chrome.exe Token: SeCreatePagefilePrivilege 1520 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe 1520 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1520 wrote to memory of 2032 1520 chrome.exe 82 PID 1520 wrote to memory of 2032 1520 chrome.exe 82 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4288 1520 chrome.exe 83 PID 1520 wrote to memory of 4304 1520 chrome.exe 84 PID 1520 wrote to memory of 4304 1520 chrome.exe 84 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85 PID 1520 wrote to memory of 3164 1520 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://loackers.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ffcfcd8cc40,0x7ffcfcd8cc4c,0x7ffcfcd8cc582⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1844,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1840 /prefetch:22⤵PID:4288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2148,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:32⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2404 /prefetch:82⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3084 /prefetch:12⤵PID:4356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3068,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4380,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4472 /prefetch:12⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3432,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3524 /prefetch:12⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4772,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4784 /prefetch:82⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4508,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:1016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4488,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4464,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3852 /prefetch:12⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5324,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5312 /prefetch:12⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4816,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:12⤵PID:780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5080,i,336889641602821006,14625734459915211430,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD58f04305bc3e60ca9082fb455545c929d
SHA1854d177acb23750be0649bbd4b511ab5954d366c
SHA2566835ed9dd467447b34ad6ba7f93920a54e35f9573d6595f40e7a922903d60823
SHA512a3c037a6e6b23d10320f43af45d41e18ba69664df8cda5204d00ca2198d1161d58e6c6ef69d5d3801a2e827029817fcb7540d34b18139deb768abdfa9d0d128b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5f237dfa8f1d5223271a116e419ea7989
SHA115da68be621e2788c7cc670979ffb9f171f23a55
SHA2563bd32a5ac4640c05f5e8273c7c6ca9903ec556066507b0726373960b3672bf0b
SHA5126ba55c860bb33b139c7b940697392a3c11b100c06cdfbd9751afaa061d219e4c42d9faf206be375ffef588a30d3792ec6c29044070994087836c4c514b29749e
-
Filesize
9KB
MD56c23fd059aec79d1275726fd0b944178
SHA193ad32e476b1a3a9e025e53a5447eb9019af2528
SHA25646c79693c873134ca9321799cc28d8bbf352bf4b7b901b6ca686f293f8f00e3a
SHA5126e469e6436641a801e16ea2ffbdc12671deb59d9ffe5e05b6245a1d5910370cc7a098c5062e63a740f99c786c326c51dc1c247e3c971c6d991714d83b2dc04c4
-
Filesize
9KB
MD5a40d7064318cbb2e614d0d117d55c7a7
SHA1bfce9bd3d75e234642ba5ceebd43841835afa5ff
SHA256f17847b76311322fbfa3602a307b7a77fa2f8e9a0184d26a9f75a858d154273f
SHA5123f1cae9ba9595fb02d4cf95d19278f296f3b2db64a23132c7c8ec1947fc9cd859250984c259143aa42fa9a7703c690598d9c0a8bbb5c6c40074a06a1e8b49882
-
Filesize
116KB
MD51c47980d9dd13e5655dc7d8f01499b72
SHA117f9f15795a106bf71810501c1fd0d9f789b863f
SHA2566e7e7c2feec490cda613e39912841923405e53329d6477a1c74b024d9ff200b7
SHA512d2736013ee30d0cf750568ce2e56bc98f79f7cbc559e305ba47a7e2009177002ec9a8d549864cc53b97d34e78a7d2712f24282808994611a9f79e3f3778299b2