Analysis
-
max time kernel
1612s -
max time network
1565s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 03:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win11-20240508-en
General
-
Target
http://google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133641928316409484" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3556 chrome.exe 3556 chrome.exe 2980 chrome.exe 2980 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe Token: SeShutdownPrivilege 3556 chrome.exe Token: SeCreatePagefilePrivilege 3556 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe 3556 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3556 wrote to memory of 2704 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2704 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2988 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 1416 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 1416 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe PID 3556 wrote to memory of 2840 3556 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb43fab58,0x7ffdb43fab68,0x7ffdb43fab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1872,i,7043024150131589709,15955683792473076182,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1872,i,7043024150131589709,15955683792473076182,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1872,i,7043024150131589709,15955683792473076182,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2836 --field-trial-handle=1872,i,7043024150131589709,15955683792473076182,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2852 --field-trial-handle=1872,i,7043024150131589709,15955683792473076182,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3788 --field-trial-handle=1872,i,7043024150131589709,15955683792473076182,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3216 --field-trial-handle=1872,i,7043024150131589709,15955683792473076182,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4452 --field-trial-handle=1872,i,7043024150131589709,15955683792473076182,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1060 --field-trial-handle=1872,i,7043024150131589709,15955683792473076182,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD588c80d8a97d3d7b3be7d28033b2c2050
SHA19b14058675e4dac051e481ded7d46bff40a14e19
SHA256667e8a3a26abc9319497b9bef1ab56f6e6fa27448fd0b9e031a243ba769da531
SHA512ba098d1438c9281107b4293a3bdf1a0180c379c3a17d5d6e60f855526823d6c7c4f81282dd6c6404e3ea161c31751ec7c0be63e6756bb552d75fabad8e3415fb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5ff2eb749a7c9b36ad45b8a15bb161f83
SHA1247d898c745bcd14ecb1dee6fc8ed4561c49630b
SHA256cc587a2dbb1944ae09e2f936b581edca46010771f50aa644ccbc1007369e2cf1
SHA51266113e913216a5c0f5dc407b0de2c799850276f2321d0c72b5bda24eb2cb8ed10730e4b3a5ec446bf4da5a4a791d867d40a23a593a5d6595ec96eb4262149ac6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD53e767ccb91a937d967d6992968855a02
SHA1118d7b02327b176cd6902ea134ecc5470bc57ddc
SHA256e233680b9e29c7a94fe72055d41ce01bd0676344f6835dc7cccdb51f1b4d2293
SHA512014c70e45b23c5f8977b2b10573eccc44a98d37ed30451bd8f8aea875a430cfdcfdb51bd7e2c3da9f0bfe8d0bf7e33c03668aa65ef78925113e6c3b4988f0859
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD52ba8b4c62d3c319b2ef20be3b2e46db0
SHA15b92583f9fa8655f883301d4761d78710307f7b9
SHA2560ddf7fdab636f0c2a0bf664bd8368c5628796ce4d46df428076c26035a169f01
SHA512b01f6dad144c91b8a6258bac2f43ce825b39bd5aa0d06019a2c79f0a5e3c39a5dc7f1a608db9bc43bddae8b0ddfaf7b09b73e868edb1b0512b834b3f4ab18143
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
356B
MD5724afb1c1132ecb8217b128ae279367a
SHA189b0fbce79293b615f78b0608ee0127ab7ca55d8
SHA256c330efcafd17461404d4c77bda668262c6100940f564d02b88112ebac299642a
SHA512b4c2c5a4ca51d35a1d7627c8619b1ccb19350a33ad4dda8f3e6a95fb88928f44941e6842b1626fb94fb10151e5b8297bcc741b6ff887cd67362569fd72f1304c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD55886c806d572075afa3ccd4fcc9ebaaf
SHA1f9d2e505da9a4a78a7ac3b84468d5df7dab991f5
SHA256f2ad75dc12d88be81575e642e6f76012882465d9c56e0b5e5d1429518888119a
SHA51278ef7bb5e821e0b755c62e5a5b6c2b40387c6441fcd9a9fbd867131a4298c6309d9fff01d480c24848e65fcdf4a5d02d87db768fcbf6e58e96ec6f7500e4d6db
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
129KB
MD523ba467fc491c8f8614b3126850b40c0
SHA18a6061ebdb856bf5f57d4414b8a9a3ab6663d1a9
SHA256a9603c54897fb22a8f1abc41d7306c9013cb1ddc68a3dcc2d357074d8698a600
SHA5124f2aa927035bd5f52b2a35ae326b59537eb8e8253ccb6a9e133be3b1c604b3f198223a412ffa4b81be1c24895af2e6ee4fb30f7ad9f0ea9a6acc905c9d54dc0c
-
\??\pipe\crashpad_3556_RUBCJIKIRRBHKATJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e