Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-06-2024 09:12
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133640395562528818" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 2592 chrome.exe 2592 chrome.exe 2688 chrome.exe 2688 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2592 wrote to memory of 3412 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 3412 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4188 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4224 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 4224 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe PID 2592 wrote to memory of 772 2592 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://natwaves.com/ask17x0qzFe5alandpharBM2ady9s3RWO3BM21⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc699fab58,0x7ffc699fab68,0x7ffc699fab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1492 --field-trial-handle=1788,i,12925871047254199610,649722238004618845,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1788,i,12925871047254199610,649722238004618845,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2120 --field-trial-handle=1788,i,12925871047254199610,649722238004618845,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1788,i,12925871047254199610,649722238004618845,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1788,i,12925871047254199610,649722238004618845,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4296 --field-trial-handle=1788,i,12925871047254199610,649722238004618845,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4044 --field-trial-handle=1788,i,12925871047254199610,649722238004618845,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1788,i,12925871047254199610,649722238004618845,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1788,i,12925871047254199610,649722238004618845,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2500 --field-trial-handle=1788,i,12925871047254199610,649722238004618845,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004B81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD5987b72ea2803d9bd293edc7451664527
SHA1936828e63ce688cf2114e8a5760822dbc54f4c50
SHA25691c97e861902c1b883a047a00cd62a2e3cdfb1cb63b571d5b9e4d02339f45d00
SHA51232b478d11f1b559d964ce41c66336da2d469ba9ede70c48cff265d6c99b46388a65fbec89c20c9bca3ff21a26830248244db57fb832f121a8f8281752260a260
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD58814f7440c5bfb7891d83bb70a44656a
SHA182ff60479f2264d6a999b989240318ee2d8b5382
SHA256fca5401a4f02a8c15a6b2920f08d338440a53179b065b11112e8ec1bc3955739
SHA512b2c44549a5f03e156e3482ff4c50fabec65b6604a0f4ce318bb4083815925881257f4cf02ca98d6fad3ddeb28da49075b942e4ebe1e6a30615b8e4eea78f0725
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD51d2dce1e123e531e19447f01a20d0e97
SHA17a5e57288d60b7a95b1ec20b20580ca2e3ac6cb0
SHA2569e1883c3f1a44577ae16aa78b63c6ce465cd431bfdc9351e1ef4c6c4f5196d19
SHA512522fa4ffa3ff62aae4627f365ff844b847f1fa1f2e5cf4ed52b13ffc248f54573c53d9e60e2e40436aca2ec7c4cef67fc837e56e9e70dcda131c02640b1748f2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
138KB
MD57c3f169cf46001c81e453e76fb885404
SHA144cd75c55288a81c894b4369d42c5fc4a8946f54
SHA256218c007ba0ae1bde27ff717451eb7399d93cbb42e04b6a2082e59fdab8ec9046
SHA5120d809fb493ec5553e1965b8a29646cd6992a138f7c93a2a46f09251ec33b40378c4e3a882baf0dd55b5715ac6759594f4ef7a7b20b8001d47ce77727bd7ea55e
-
\??\pipe\crashpad_2592_VRAAMUVLSYVZRMCWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e