Analysis
-
max time kernel
41s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-01-2025 15:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://vqr.vc/mTUa6EndJ
Resource
win10v2004-20241007-en
General
-
Target
https://vqr.vc/mTUa6EndJ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133821197450700730" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3704 chrome.exe 3704 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3704 wrote to memory of 1864 3704 chrome.exe 82 PID 3704 wrote to memory of 1864 3704 chrome.exe 82 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 3612 3704 chrome.exe 83 PID 3704 wrote to memory of 4348 3704 chrome.exe 84 PID 3704 wrote to memory of 4348 3704 chrome.exe 84 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85 PID 3704 wrote to memory of 5084 3704 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vqr.vc/mTUa6EndJ1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa5694cc40,0x7ffa5694cc4c,0x7ffa5694cc582⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1988,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1984 /prefetch:22⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1836,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2036 /prefetch:32⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:82⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:1336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4588,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4392 /prefetch:82⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4596,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4392 /prefetch:12⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3140,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD51b01ee9a7aa178580b920dacd1d2a29c
SHA10942b39b6adb091d5504c0a7dc838cd792cf2106
SHA2567de381cdc65dfbdad63f3f9298dd7a874d8c2ef7ff6249e589270a71abf7f921
SHA512a15a59b413bd9f2de05b0103e9cbfe6486e24d4913ccbfdff6845495e7d2691d6a16c324b8e84427f1451d2221b70df06f8488bfaaebfab487ef5eb5eafe7e75
-
Filesize
240B
MD59b300bea5898ccf104bbd57485b5e677
SHA13a218167752f7457b774624c5f13dbf199a0498e
SHA256edf0fa4830ee4d0381213bff719a010aa7de4929ab9f6cecaeaf9843f735b8ec
SHA512bff8efd7aca2a87ee7f79d78425a49f0f1b74590e17fbc99824005e56be1888c427dce0c259f146c0a46736cd9ed2fcf6b550fa4e0134f75ce7b6e3856e0a7f9
-
Filesize
2KB
MD5f1c3fd24c79ffa46296ead5689452724
SHA17f9640d7001772bd0d068e0a35424ea4a3d8ca0c
SHA256904d84dd2eb7c018b7e86206e934d014d6f5cd95e9f75eb790b8a43dfbda2c5b
SHA512fdf7b3a3254e1e8b6fd57c522da3e948d0ac824cc81f7dd86d6e829ee7934872f20e1e11751761d0224263e0e7c0758a50e562e4f663ba5ead638925724f1f6e
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD5ceb0f0c99a5ececc3b5c427c58b18011
SHA1fd4eb22b8989bec7b69d751fbddd3369dc5d05ba
SHA256eda9b68a090b17d56dfe36bd60973f8c09de02d970f1d64573ceceef1f21985c
SHA512f0cd6a4cdb594f78d7fe0d9a6725465297f92f5e4e128d388823c78cec7c9d637345cb83cca755757d1337da39880bb35e2ef9cd5e5876a7bfc922371882c982
-
Filesize
691B
MD5a41afe7e426fed0aded2416c1a29e2f2
SHA160b73f69bcaa308e91619e682be12de122f2cb57
SHA2561fcd975e04a57087fe79ccf74ef7a58820ad2144964b3f9627fbdfe5f5a339c3
SHA5120e991b6d5d47a911541498273892e45b0796297f4172d402565d334043cd29884c0742e3f589c26a42a48b65dffdd4034d512973442754b2a64bb58a03b9e5b9
-
Filesize
9KB
MD5811be7a36e9372d1fcbc128b78c0aa26
SHA194d3b1cac687b5f611fa706c56b3ba2ee6f27d92
SHA256779e4dbe35d217987c341c7d3d5cef6faa779dc2d44d20c5af89e9fdcf3bc888
SHA512bc362886357a5fcc488a95063744779bd20201c15e9bdea50f2d445e78e17de7d1a30029a8e6cbb486680a309677b884366f40a892bf32777ea6c111520f3b46
-
Filesize
9KB
MD59a6f99c7603077548f2efe8472d18357
SHA13144afbc3292592eeb44d39b7a03cab4b4e3d967
SHA256957841a617850d1664b5717fb6c9cbe6c38c29425661cf6069eace264a9545ca
SHA5126916ac00a4703233fc02e03d1b41bd6386b62dc18a5da6362da17809f5e1d5179bc3e49ec127e3b294a675fdc2a2c4030e080a525b0688b4a362b643db2889d2
-
Filesize
9KB
MD5e68d935d43e97543c96bedd8d49290a6
SHA19c0880ed1c0a10f2cc48eee1594ed76f48f771e3
SHA256412729075403bdd0561aaa5fb8a9c8a98840283da598362b2b36a2af82b67eeb
SHA512ce741242ad5dd5d29639d8115018b3c70bf10e178c7c74579b21bd3c540f97ec2e726a53f98a69b04664e36ba18c112e9ce42f0511e315ca8cf3758a86b46cf7
-
Filesize
116KB
MD5e7da9b65d09c507a26b38de63bd3e12b
SHA13c707ac8709b9396eae823885642c312688df677
SHA256d427339285ede549234ea26f8e6b270f510cbfef7a515dbffe132de06e85ede1
SHA5122fbc4e8469137fbfc0ca04595ac847966221a11dd498aa95ff5a93b46d7b3535b839719bc2b2863d27f00b6b83b08430a3947c4709fd695a41ae202014d6379c
-
Filesize
116KB
MD505f0eeadf5b00e9e3a433d2409665ee3
SHA1a210dc6260e76f333e5240a4fe89e14437912860
SHA2567606863ac3487d53c76f157e18bed11bf7769ce7ab7f8c35a4afe874220f29c9
SHA512a7f1581b4efc00ecb3d7896d21f9c89e5262a9ae2dc92a312f01b2d0fca7f8465d1f7f67aa979958806e44f1dc7341888af07c5baf550c494dc6bb0bb3966055