Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 11:52
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133643947418930160" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 2240 chrome.exe 2240 chrome.exe 764 chrome.exe 764 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 2240 chrome.exe 2240 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeCreatePagefilePrivilege 2240 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2240 wrote to memory of 2304 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2304 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 2904 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1408 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1408 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe PID 2240 wrote to memory of 1416 2240 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://krs.microsoft.com/redirect?id=lxDNVZKK1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa408fab58,0x7ffa408fab68,0x7ffa408fab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1944,i,4709949986648448794,11007546162032098626,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1944,i,4709949986648448794,11007546162032098626,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1944,i,4709949986648448794,11007546162032098626,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1944,i,4709949986648448794,11007546162032098626,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1944,i,4709949986648448794,11007546162032098626,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1944,i,4709949986648448794,11007546162032098626,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 --field-trial-handle=1944,i,4709949986648448794,11007546162032098626,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 --field-trial-handle=1944,i,4709949986648448794,11007546162032098626,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5fef238ac5f8221fce89a4531416d7fbd
SHA193cb1ea55d2e67cd00003a3d375713cc0a455708
SHA2569485a5ffb5a2fda4abf93a79faf306452e641f9ff0c795b958aeb67b5cf9ae0f
SHA51210b172dc6dca430340681a90fc6c3a777e8e34245313e16796d4b0bdff4fca39955f612e2de02e8b961197b055f87d69fbc9d2e7c8b981164b7b3cae80603f3a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD52b62f79adce083ff50987768468d95cf
SHA17e232669d3d12c88b5a38a7e39796f1b31a4bf74
SHA256970225ba231c4637965910db0b0b49cfc44978b3ba4ac2bae174ee29eb1705bd
SHA5123bf0b0f7e6ba76b3716dd413f944e69b16afc636e95d817fdbecd5f34cc00fbd96b32dafb1bff3cdb3b019616ab7a4f40ef33d578d98900a194fbc636f34c539
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
692B
MD5580b657c00aaf9fec5148c21d835f04a
SHA1e8bf0f3f53e4fae1609ee652318e5c672e843290
SHA25641c74e6ed6110a593c3bd4849cc26cab360f596f5a8ea5e00ac5f0fdd8d047f2
SHA5129f001837f97ee2154408b3db686c1a96d8aacca90d23d80646cbd288da8cc567598dcc4b82850e49d6fcfb9d7cb0df3b8abf29ca7fecb047e97388c030f964ba
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD581b805af73d2d395c375ecc6e4cdee5e
SHA109ecd11132d5e5cff7489b9b122a84627226eb7d
SHA2565b65b67f7935c8e52b72d4b36b3501e7d0056b138ca781fe61a65301db36e746
SHA512e30221504702791a90d4c91797e337b8a995ca878a253ba68c808e65f2bc41a6cbdd6c93d8d90afd8eaf912c41aa6755accf4b1a1413432949be628723912434
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
138KB
MD550b19691a05988fbaaa5d8a46796679a
SHA12922b14647f08f09e8684a0e3084e995d3577fea
SHA256b44e67a64837c2abf28cb4d35ca80ee466a39bf127fb6f6bbb0b677169d94e47
SHA512a277e054663df3e72edb7ecf8a03dd2c07ce32a642825e91cc116685ae48f84fd44775d4ab11afa1834facefc2d37b6bfb9ef8147d2239cb2b0ec567dec17b30
-
\??\pipe\crashpad_2240_MYPVOISBKINWLCFJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e