Analysis
-
max time kernel
90s -
max time network
55s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-12-2024 17:15
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133789295443258556" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3788 chrome.exe 3788 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3788 chrome.exe 3788 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe Token: SeShutdownPrivilege 3788 chrome.exe Token: SeCreatePagefilePrivilege 3788 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe 3788 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3788 wrote to memory of 4196 3788 chrome.exe 78 PID 3788 wrote to memory of 4196 3788 chrome.exe 78 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 3868 3788 chrome.exe 79 PID 3788 wrote to memory of 4276 3788 chrome.exe 80 PID 3788 wrote to memory of 4276 3788 chrome.exe 80 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81 PID 3788 wrote to memory of 3772 3788 chrome.exe 81
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://store.steampowered.com/1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a130cc40,0x7ff8a130cc4c,0x7ff8a130cc582⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1808 /prefetch:22⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2032,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:32⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2164,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2192 /prefetch:82⤵PID:3772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3088 /prefetch:12⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3052,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4632,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4644 /prefetch:82⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5be8868d3bb0d9803ff515a9e6aba9185
SHA1ea2339ad7e1f0308ae79515f64d57d4e0389486c
SHA256bcdf63ccf0d76e9084095791ece780779c7b43f29584b82367ae3b1ea12f3b68
SHA51245bbfd0b2f295587160a3005854eb0fcabb01e1286e2a10baf196e2066d087f85df3ac362b4f18d6184ba0b26b933e03d3becc0ab901b2321d6e71ce03832850
-
Filesize
504B
MD57faeb1073471f2db03cd1aec56b0a9ae
SHA13326962b2c5bd7e6b4f7ba3f3466f193cee4b368
SHA256dd1649fb16fefbde139fd258d088f1098610aeadd14968e62c27d9ed2ecddd4c
SHA512d528a2f2e5f088135db6df54f51e43dccf36e9a905219a32e104a721d5472b8c8fb65b79a5dfbd9d758f231118a6209c9ea756e4ce8be24946f5323a58a4a512
-
Filesize
1KB
MD542428fcf7d2b4884d26d85ebcb620299
SHA1d7939c1741c529765102129f4f635fab3297cf03
SHA2565e071368ba6a9260cc6ca527cf3738dc644047e25bba621304d6586411c11c5f
SHA512acadc8f5d16dd098a4b7c81cbc895ec02331adb08b0d8084a76f0c9fb697444d290d723689e75f21e1d8d608bce44b421d04a94cc68e2ac5b7f6304789805bab
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
692B
MD500d87f840b5e76c20aa7f31e6f874ad7
SHA1b8f9356198cc68053869a7164c62c99f7f6c604a
SHA2565c1594af5095e3d3ae49374aea6c3fedf920541aa578da05c43dc50e9bbd3461
SHA512d6a1c602ae11786c89600107a89e72ba9aafe0fb5331fe5ebe9f2920b557146a6f1d9ecd2d46b4c3278bda90a485fb2b56964ec2739f1ac2a6152b02b53269f9
-
Filesize
9KB
MD5df896d68b7ffd0f1baa652e618d2269f
SHA1b0facc440a2e5fa44ed0224913094fe1f00dd404
SHA256ac258a1ea6a2d12b242cd1bb8fc29328ff9ccb0f35db5966cef9826881edfc37
SHA5121734e50237c81c8e2e11472ed38f8f4b293037b2d1feee26eb51f09ab1fee7068fc16cfbac66687101f07a183b7833ca7b2ca9bf198d5f68134be63e7087e659
-
Filesize
9KB
MD50e796a79000e70e5c5e081aa2d5110fb
SHA1494660a5b632f797cf47cd9e5e5eef8bddaab537
SHA256b4a23a1507817df4b4fa5d986b12302713caf5d5d20b9d6db8447921699b4a08
SHA512b3d68f7cd6715712835ab368b5b0b343362885a7e21a239a873c30e01a55db44695e967c3f3a7b87ac9802484289df0b0e62b3b30480d4c7d5ea11d9ba9adb07
-
Filesize
9KB
MD5a004b5474bc33aa7177e0e27c1fdfd5b
SHA14dec42b7f4f59df328d9b24d745978553a752445
SHA25651d4cae71a5cc75d5e1b307fbcbf147ec282138f80956aab4c928c7c417550f2
SHA5121e5954a1b20510953c0dccc5ffcbedcddb9c119c531037c8b144597e1ea2d52b416301a42dc0008c55d85acac85035010d6543a4933109bac1d1fbe256b9a766
-
Filesize
9KB
MD5519bf55be235fd56e6bb53611a926322
SHA12b12b42b2ea0724174f6cc6806e42366ce784593
SHA2568d10a5359ed63a905fe5611a67f3afee18997f952e724d8845c022e335ce9065
SHA512c1c1dca8a366506b96a9c7a7afc52ebfa02bc5dcb1990ed5f839111d412e1ebf6d502bb649f256de7497fe1c5ec2057aa3ad8b33b239792654c37ae7ec3087b6
-
Filesize
9KB
MD5903966109b066a9592522f32ec2521a4
SHA18ce0f1b860daaf0104004759b706fafe116c7ca8
SHA256e07c3ffdbf48d955be72e85f5ec99beb05d3ee0322f0b4a891429307f10cc567
SHA51208be04b2172bd62020d19c73c7a96fc981ff7dc458926ea20f38fd5034ed145948098f8d511ae15fce3ba3b84b3b8cb8c39ef80a87e206409a999c199442c4c8
-
Filesize
9KB
MD5e173fc014d91f499e2b2643607626324
SHA1063e683a580eaedb7db0477ab9914eecbc38a155
SHA256c031ed7d0346c77331397416165d43eda5d1b2730f1632964f3a3f50d55da0a4
SHA51252b2ee3ac2cebd61d7fa56a1dd27d52b4f92ea5a348d3aa318d266f9ccc21b9caa833cccb30a89d75c401690c6181a86a72be824cfc933e877fb378e85220b5e
-
Filesize
228KB
MD532248c321ae35bf06f6108a013b1ac17
SHA1f44daedc960a405aa18fc7cbfb27b4be6bc4c8a9
SHA25649554840195a985994d4fc3b7374f35450bda7fe857349d77d8dbcb596c3ca79
SHA5126e9b87de893254309eb2edc114e30f8fb30394197937b1ab6b31f5e4cd71611649c188469a6c448a9363d63b032292db2770d0dee8ca494f2238fecd34880154
-
Filesize
228KB
MD52dfdb69b762c3b79afec52e34946a844
SHA167c3bbc78cbd32c588a155b21ec4a136efe58363
SHA256704ff0cf3f5507137b867fdff70ca48cf926a82150f77ed441feca8e27e8f035
SHA51269f5fd7483637a08164cf2d74a03101e988f73269c5494d0c11305f6fd7aa9145750d93ada3c3f838bae9fa83a59894ce4f871da0c1303df7ed85b007e17ecab