Analysis
-
max time kernel
6s -
max time network
9s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
23/03/2025, 01:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.virustotal.com/gui/home/url
Resource
win10v2004-20250314-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
https://www.virustotal.com/gui/home/url
Resource
win10ltsc2021-20250314-en
dharmatroldeshcredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealertrojanupx
windows10-ltsc_2021-x64
37 signatures
300 seconds
General
-
Target
https://www.virustotal.com/gui/home/url
Score
3/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871668562930941" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1104 chrome.exe 1104 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1104 wrote to memory of 4448 1104 chrome.exe 86 PID 1104 wrote to memory of 4448 1104 chrome.exe 86 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 4028 1104 chrome.exe 87 PID 1104 wrote to memory of 2720 1104 chrome.exe 88 PID 1104 wrote to memory of 2720 1104 chrome.exe 88 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89 PID 1104 wrote to memory of 3080 1104 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.virustotal.com/gui/home/url1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe0caadcf8,0x7ffe0caadd04,0x7ffe0caadd102⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2032,i,17366729965950407893,10308692670296201560,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2044 /prefetch:22⤵PID:4028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1552,i,17366729965950407893,10308692670296201560,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2244 /prefetch:32⤵PID:2720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2336,i,17366729965950407893,10308692670296201560,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2384 /prefetch:82⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,17366729965950407893,10308692670296201560,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3204,i,17366729965950407893,10308692670296201560,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4408,i,17366729965950407893,10308692670296201560,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3892 /prefetch:22⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4712,i,17366729965950407893,10308692670296201560,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5384,i,17366729965950407893,10308692670296201560,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5400 /prefetch:82⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵PID:3552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
215KB
MD5e8518e1e0da2abd8a5d7f28760858c87
SHA1d29d89b8a11ed64e67cbf726e2207f58bc87eead
SHA2568b2c561b597399246b97f4f8d602f0354a979cbe4eea435d9dc65539f49cea64
SHA5121c15b65bd6b998254cc6f3cbef179c266663f7b1c842229f79ff31ba30043837c398d85296fb20d3a576d9331fee9483ca0cbd06270da2d6db009bc454aee0c7
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
80KB
MD5bb77a99623d3320d4df6932893aea7ac
SHA1cc7ae5f45c4d34dc409f9f078af47b88ef0e3da4
SHA256d5e8f3033ec0fe862c278d63ddfdd73441944984877e8b9e81601191c7150927
SHA5121ac41770fb2d76a9da48acd5d88eadf5a760a32d51d6844dc8fd09f287f4ae029203bd2b6a776e35c3e9537d9d0d0640f0c623b1c49abbe7ea8e6bdeb7a20164