hxxp://167[.]71[.]245[.]231/backUptester/1a6cih2w9s[.]php

Analysis

max time kernel
149s
max time network
143s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
17/03/2023, 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://167.71.245.231/backUptester/1a6cih2w9s.php

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133235610028301636"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4124	chrome.exe
4124	chrome.exe
4828	chrome.exe
4828	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4124	chrome.exe
4124	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe
Token: SeShutdownPrivilege	4124	chrome.exe
Token: SeCreatePagefilePrivilege	4124	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe
4124	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4100	4124	chrome.exe	66
PID 4124 wrote to memory of 4100	4124	chrome.exe	66
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 1516	4124	chrome.exe	69
PID 4124 wrote to memory of 4248	4124	chrome.exe	68
PID 4124 wrote to memory of 4248	4124	chrome.exe	68
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70
PID 4124 wrote to memory of 4296	4124	chrome.exe	70

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://167.71.245.231/backUptester/1a6cih2w9s.php
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff5a0c9758,0x7fff5a0c9768,0x7fff5a0c9778
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1740,i,466704140975079406,15014110356424206611,131072 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1740,i,466704140975079406,15014110356424206611,131072 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2128 --field-trial-handle=1740,i,466704140975079406,15014110356424206611,131072 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2672 --field-trial-handle=1740,i,466704140975079406,15014110356424206611,131072 /prefetch:1
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2636 --field-trial-handle=1740,i,466704140975079406,15014110356424206611,131072 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 --field-trial-handle=1740,i,466704140975079406,15014110356424206611,131072 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1740,i,466704140975079406,15014110356424206611,131072 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 --field-trial-handle=1740,i,466704140975079406,15014110356424206611,131072 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4428 --field-trial-handle=1740,i,466704140975079406,15014110356424206611,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
30953edaf30eed736465af7888b591e8

SHA1
9292e2c2aa465074c08ac7f66a367df2d27a8713

SHA256
1719e5184f48b64a741bb203deb85080e509bdec8cc062c8d2e88614c47054b5

SHA512
fce23deae6af40e56b3d504ea16611f670c95faf13b90151a4b4371ffba81ff25a8d3c4f6c198d08160ad0e7608271529fe987ff7c94ff60f7373def48b108cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
bab4b8064a488044d8384bee06644993

SHA1
9f689195fa1d2216fd700ba0483c887383eaf892

SHA256
44edaa1eadd5c25515a1f8df523ece072f8e663e0fab2dca9618f1ef031fd190

SHA512
769b6800133be551d5f64d570b8612a1fd17f149675d9278d29d5d6ab969d945f90bf3d4ca126ba305a0497018ce04b0f877af642582bc024cf5d56c7cb5f3cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0ddf9d38ad8c657c56e0397616e872fd

SHA1
8fd4b55b9f4b6b0f1f865702c3ac20d30f86cb92

SHA256
120565191ee62dc8f450e5fd3740829cb598b1ab2babfaf837bd2f2e0a5be013

SHA512
25f53e8f9116dab409a01e838d6a606de65c38a84e9fab895df8a30320e39dfa9b76e92676f5763597dbeed5a2ad2faee44075f4d9e79e5bc639def0fd8acde7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
d8d19375042b2f292c054c107227c73f

SHA1
929e06f1750ec08b3a1f9d11282996a65155f5a8

SHA256
fc6795d452ec0b71726d62b21643c8569588259b6558455126abb38dec207b5c

SHA512
169204c9d8ec1879ca2e4a0f4e433362094b6a03b05c198dc7989abb52234092f42b889472af38d65cdb2e78e204c5bf75a6ba8529dbca2cf67c5ee91a9d78a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b369ffc0-d813-4b99-9881-5194a727f494.tmp

Filesize
5KB

MD5
9693be46789d384fecb17b7fe32d748a

SHA1
7bee349dbde7c449506fef12d246b81afd0bbf3f

SHA256
6208c1cd1e3d0e6bfc29c4f74d2241a6055db0a7334e46220671779e2ee6e02a

SHA512
b130e58b3393f8ed350b7758d0a4d40e3f92347269960c84f85dbc0129dcb4191e20fadfb152c2821e0cadb6f37d639c9c800bd471a8e68617de765613a163cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
143KB

MD5
37fd501ba269be2f1f484c25b0ff0136

SHA1
acc9a815c0ba569ebb4ba5d08e6213da820b9c41

SHA256
4d700ced4792aea59178b8a52a3d8098b05974776bc2e9a7e71039dc867923c8

SHA512
01c93d131f0852b6c239908a2a3f7cebac5693370e61340bcb680a9d6e929f3a90fbfa868d67176e196f76475bad62ee8ff05acff2df4a78c4b9f0765419d083

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit