Analysis
-
max time kernel
69s -
max time network
70s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-01-2025 14:38
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133809071200144138" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3604 wrote to memory of 560 3604 chrome.exe 84 PID 3604 wrote to memory of 560 3604 chrome.exe 84 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3784 3604 chrome.exe 85 PID 3604 wrote to memory of 3884 3604 chrome.exe 86 PID 3604 wrote to memory of 3884 3604 chrome.exe 86 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87 PID 3604 wrote to memory of 1468 3604 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://checkout.shopify.com/gift_cards/92487844169/fcc85dda23947f4f473efb87856c693a1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffb6b1bcc40,0x7ffb6b1bcc4c,0x7ffb6b1bcc582⤵PID:560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,3124625347659249134,1358377965925544872,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1900 /prefetch:22⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,3124625347659249134,1358377965925544872,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2092 /prefetch:32⤵PID:3884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,3124625347659249134,1358377965925544872,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2412 /prefetch:82⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,3124625347659249134,1358377965925544872,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,3124625347659249134,1358377965925544872,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4444,i,3124625347659249134,1358377965925544872,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:12⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4612,i,3124625347659249134,1358377965925544872,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:12⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4620,i,3124625347659249134,1358377965925544872,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4952 /prefetch:82⤵PID:716
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5b0d7386c81676b5c941ba9a0c09085f0
SHA193eda25972041d3c08f44a1f2d99374bc32ed7bf
SHA25656982ad32983324f91077fb5d2d5216e41eac4267725336940a7f6ba247d9dad
SHA5127fa5fefc661400ca67010d749e6a3fe6561aa9ee359c86a57b5f99f36f8af73cd5ba2925f9266768eb3d3346f92084cd0ced04b1d95fa7ef3dda1c4aca57fa74
-
Filesize
216B
MD5af9a35a9aacbdc2d2674fe1e64f8b012
SHA1287f48ffbb2e5d80382f640dcfe45d00beba0faa
SHA25675cdf8d979e7244a1c91e6723692c2a0f2abda46523bf4dfde518fa365fbc5c7
SHA51258dddd8c2cd18b87798c8ce52ce10da25904609679b0eb9f1b16d6f2261496097f771579f87f57059f8731354bb72b8b79d8df7d3fbe8da9ad97be4915a0da04
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
859B
MD561311704fcb2dd601d29c2a6ca667836
SHA1f355b62331d0bc4f5920ba7fcc8955dc899aa905
SHA25626c6ef708f941c2c390e048fd0e06e4e6425a2e18feebe1bbd165e44740741b4
SHA5124c1bd56b819f1ac3a890092c3e949397fb88dc169a73b27b4fcc3507525ff7f21e01fbbf7b86c845b74f79ec4a02b710f548107ad0c5d3098b38b9a952fef163
-
Filesize
9KB
MD5ffc3f37097f1e294d60a43abb6820eed
SHA1b8f8e9f06190a8039e77229f3aaa0731e58d9a66
SHA256ba9c1fd395bf0ecc12cf1862457d9e27b9ad1e189437ca63705662800192eb0f
SHA5120d0104845f129a7c2264801ccd752fd80f75da99784e7c4e9a3fea9cd1b6bd2d080d0544c65c0e8f411f2473dc0a8bccd49b48696f936e9625deecb6eb2f34bc
-
Filesize
9KB
MD5b54ccf919e157548d0cba1074f562182
SHA16357a5590948f3c4745fd26bca0803da580b4068
SHA25643927a452f239586493d4e597f4ae1ff6aee91bf0ece73779e6bd210569d0e9a
SHA512a625f541b66cbfb2d45cb0628157d64ab7aa1841a0da9d1e46eed185469ff7810f8729f380231e119db654f5f35a059fcb9e43199e878ec31a0ab138b3c7bf16
-
Filesize
9KB
MD5c127ca9417740c8a742dd57f8feb2353
SHA1515d1018248fb323b6f77705b7d14cb6d55a4562
SHA256cec52865fa76a3dbe935abc18034f0fd79dfb74692d149d5c6b8d57e1d103a14
SHA51298f72884cdbf1dfd4e1588ef4dbf6035bb4c601e9d3f17f66c9c454ece22734769b25c2c854b0e0f10002939285b00591f87145d42c5a77e83c749df03b85169
-
Filesize
9KB
MD5eff568baf6ad1ed925a4b71a7d8a072e
SHA1dfb6099a7341fed4f83da8c3eca2e6c7dce7edb4
SHA2562a939889fb11860de18a30ef3c4a610416da61e51579b2b76b55cc41d1b0ad36
SHA512cc51291f5916286e52ca8ef75513ef12f601fa139a9392b4051002f539d62894d7ce0c640bb492334f676f6108f206349141a2563e8893c5eadf89c5f15de460
-
Filesize
116KB
MD54ba819242bc376b0566218953758111d
SHA1722809368dac2f3555ddb1ef20e14c3901771e89
SHA256e2404ef323e48867ef1f3a9a004b2f3d80636450351e2c86751b6f33fbc612f6
SHA512fe948551d7b1e707c1a093873f198c3c153543c7376afab649a0b859100dcab455a581e51a80d84c20d3102a11953840ee9582c0af4d1059a3ebc06f2262ff6f
-
Filesize
116KB
MD5a909111ff6674d662932e9119d808467
SHA15bb16b89bcb2702ef4134171274cc82c93fffccb
SHA25670054c2dbcbf5044352041c43b53a399059c46f57bfe9e6152b162664a0f3895
SHA5124b155cb95ab610f0da5461fe18ff0a591779a6d9c27a4d5e14afc2a00283677a86527dc7715903fd629a794ce07f42d24b506403a7ba6d0853f38cf81017cd67