Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 16:19
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofastup.top/INGT76546789#Zmlyc3QubGFzdEB0ZXN0ZW1haWxvbmx5LmNvbQ=
Resource
win10v2004-20240611-en
General
-
Target
https://gofastup.top/INGT76546789#Zmlyc3QubGFzdEB0ZXN0ZW1haWxvbmx5LmNvbQ=
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133643243852759102" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3368 chrome.exe 3368 chrome.exe 628 chrome.exe 628 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
chrome.exepid process 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3368 wrote to memory of 3708 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 3708 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 4028 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 1652 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 1652 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe PID 3368 wrote to memory of 2072 3368 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofastup.top/INGT76546789#Zmlyc3QubGFzdEB0ZXN0ZW1haWxvbmx5LmNvbQ=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a24eab58,0x7ff9a24eab68,0x7ff9a24eab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4528 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4648 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4784 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1864,i,12183451266704394234,6192000427753647670,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
96B
MD5d794230b3254626e2734de9fb4bc431b
SHA1310dc8152263d733d4c9e529a5b93c2948c15c12
SHA2567ffb63f0beea21a72c7ff1c11b39cac198f1aabd539039da08311b645e9770d2
SHA5127f9b4a9f7293e80cbb866ae128cb7ba4344a3d7a1395349741ec83aabb99050955fd5ef537fdab546a3ca2f38c592d6363ffa343099735246369ed80b35e0164
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
120B
MD53bbe5110cbd2a66777cfd39ca63a4df0
SHA1ff6d2794ab3b9ddec762daa2460870571f331db2
SHA25649929751d1b0584af3de31c01ed80655e5962f77bedfd290bf8777541c2f78d5
SHA5124383eb91b27a89f9c8befc4329b1975b40ce67bc29fe41c9da23226eb01d656c8553c60ab9bfef94693e3c312dd657e9a565191248d673e7e4f6ffb84777c415
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5afe8e68f617b73e42fa71ebabf4e9bfc
SHA146da01c9d855df57d4e2c327815c2897ca71d90a
SHA256bb08958ea468cc855f5d14478c1b46c831e8eff3f43dfc3ef69045afc040b72e
SHA512ab4971b09a02091509660f3e27aed527bd36165735300e79cdf66c75e47de11edc9b359d448a569e2484ab593902fdbc089a914e7c540fe77b838536ddd1158b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c44660ae-081f-4ba2-87fa-2b19ff783c83.tmpFilesize
7KB
MD506968ad2c68ec86b901ccd9bab8c358d
SHA1bf0bcf3e00fa68efc3e55be31d9a07733beb65a3
SHA256a4e81c160fa9e0bd20913448f50f1f907faf18753193de0dca1d17b4604f6e74
SHA512e5e0de41294ac1439a7d7dbabf0a1c104efb7e735533cb4f2c0eaacc52615b15c8bb1dd1108c4ea62b6c5686dd7775827dc1b0e61c46e0d831fcc28afb197168
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
138KB
MD5b64b79fbdece3f5ad1b858c3db101b40
SHA17af7fba0a268b5d2183ac0e73f9e89ca4cf75f85
SHA256b81b7bf46bcc4d7eb61bffc3f11210bdc6da9322c728909f1e96567cba15480e
SHA512f4bca672160be0641bf6937bf0e3e12e5e2814c43dde03c247de6ec673df0966ac221800244760a4367f82547d6758a98f598b6bf5ab7014dabd4899108e3aa6
-
\??\pipe\crashpad_3368_CNWTYEZACSJSESJXMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e