Analysis
-
max time kernel
89s -
max time network
90s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-es -
resource tags
arch:x64arch:x86image:win10v2004-20240508-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
24-06-2024 21:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sc.link/zQUxQ
Resource
win10v2004-20240508-es
General
-
Target
https://sc.link/zQUxQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637371729552297" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 5108 chrome.exe 5108 chrome.exe -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
pid 4 4 4 4 4 680 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
chrome.exepid process 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 5108 wrote to memory of 4488 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4488 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 4392 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 3832 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 3832 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe PID 5108 wrote to memory of 1584 5108 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sc.link/zQUxQ1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5589ab58,0x7ffa5589ab68,0x7ffa5589ab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4560 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4488 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3892 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4748 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4472 --field-trial-handle=1832,i,18414855092555047551,13135310180700345964,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD51ec50ea739c33a4370ec65e8b1528f84
SHA1e2da7a0cb6f1ccd0e2574f27dbe093a456911bbc
SHA256b6380940715ac8592bf153164b602b87e93eb46e1679c3688ef9b8393efec110
SHA512ea50ea7df3e8d9cb73d75436481b656a60b67bde47295cf4cc1d52abba326a663b32de16214975607c3b7695ab042cdf43076f116ca38b93b9ffef954cfd20b1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD58bd73022ec1e72c58c0a589348ae4ef3
SHA187c97a1044f8a17e02a4644ad545b40bebe80b16
SHA2569284c616669c6252240c954efd7dbc7f65d10aafd9db283b4a982d550f09f6e1
SHA512f0cd666e4ed6f62f86d3425f26639e50597fe551ff0523568580375571cc1763f3a68a8c479de57d2dedf183c74e870fcdf0822a75ee4d4aeeff56f2e73ab791
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5ccda59b7da4e3e5db7fd4ee392e8975f
SHA162b9dbb0f4c1962799b4ce32a8f793c82f377ebf
SHA2569c7f6d7d78310955c89c3b8f3c43fa7785009c07f69e325b49b89cb84d330055
SHA51210533246448784e1ad139f1a135c606d50c5e811c2e275461c5035d4d4cafba1823925964bea7d346a07d19862f05bf8dbc6c79bcd9300a789c6de3f664cf8a2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
129KB
MD5a26437595642b6233f3e0ac63b940e9e
SHA1ea1bd8a257777f9c2a5fb7cc7657a8f875a25024
SHA256e69e8d6c96dc1caf467045d6db8db548671414b5d24ab84f761adcf1d24b7260
SHA512938b25f4785b1ccbf48e88ad258bffeb28587494c6297fded301a9b72bab2a17affe5e61e52fb00cfc78e2617d8567b8628bb8b79eaa84fcc05e8207a1f2c6cb
-
\??\pipe\crashpad_5108_SALQNFMMHRFRBUFTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e