hxxps://ipfs[.]io/ipfs/QmYvUoMuXQJY5PkGH7sc2EA8ERYYnKCyJkWL77gkKeRCA2#orf[.]dom@scangl[.]com

General

Target

https://ipfs.io/ipfs/QmYvUoMuXQJY5PkGH7sc2EA8ERYYnKCyJkWL77gkKeRCA2#[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133239643248350983"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

4632 chrome.exe
4632 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

4632 chrome.exe
4632 chrome.exe
4632 chrome.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4632 wrote to memory of 4728	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4728	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 4784	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 3760	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 3760	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe
PID 4632 wrote to memory of 2172	4632	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://ipfs.io/ipfs/QmYvUoMuXQJY5PkGH7sc2EA8ERYYnKCyJkWL77gkKeRCA2#[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84e699758,0x7ff84e699768,0x7ff84e699778
2⤵
PID:4728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:2
2⤵
PID:4784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:8
2⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1792 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:8
2⤵
PID:2172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3224 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:1
2⤵
PID:3228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3228 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:1
2⤵
PID:4852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:1
2⤵
PID:4348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:8
2⤵
PID:3656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5284 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:8
2⤵
PID:2220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:8
2⤵
PID:752

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
909bd36bace309dd66ea7c0580f0beb8

SHA1
44ce836092894c0685aeeaedcfceed5271ec129e

SHA256
0d278815cf66a030452a870253b16215f213407e43f67e602c15b6cca387b1e3

SHA512
2f5c658af78ae643dd4802f72cb5ea02aded767eeff3c4b56273dbbdafddac4b5f22f54003f28aaf9d1e1401bc6ad998f659aa7439919d18de7c25261ccfc933

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
538B

MD5
5737700b21ed8498439b3d09b5540cb1

SHA1
a2fce37bb09688c971d5098e3bc3bbfc40cac435

SHA256
7ca1f5d9b6d7513ab9c49fca4a69d24c48affc9e47020e4b3404ec1ecf35d68e

SHA512
dd56f37a28f57a1205dbd077909e2e0e6625e80fa2bec7fff94c571af8c7a22ebfdebc93ed292f13482a94ca7c83c1655f1a7fff662cab6c181b35d9ee796681

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
1b1ef1caf3b0d6caba67f64fc4845c24

SHA1
9627995d28b3e09dc467bc0f28dd491c2b948080

SHA256
ca2446cbe1d76b1ecbc86d227661b5f59ac33cf0834eb9e094a57d2a62f901c4

SHA512
0f7a40b0a345dc259b4aa87954ffd8127e96480f494ffeb77f1fbc30c60c7970ad1109141ed856fb8adf225128e16fb255f4d38c6a850a501cdf27841cb102da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
0e59b29d6c093fd1632d787a7176df1c

SHA1
b4d85840b5ed4f1330c37907c62981970d3088d6

SHA256
2963fb59ec0c3bc8eed19d1e37a991b01d02c9ce5610439848b5a146bde9d196

SHA512
328f57694848b21b7192dff9a481ef1640736853602d5269fe348a62f06cd8f0cf0fd6775bd0079d41bbc50ccd4edb96b1b8e7123c3ffaba99c611290706c061

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
144KB

MD5
d407209239ec329a7b750ac862e40c6e

SHA1
9e621a6f94ace7d34d4fc783f5ad6dc7882fdba9

SHA256
deaa723516354669c1198745f853b4910ff1ab09efd9248f35a8e8d294e66546

SHA512
32b24fe159d47e3a78fd9fe18c82b7671df57577a159b5dfafc9feeef4bbc3b8d85f5d9ba4a87720c188f1b8798d18f8e6417e14efd8173fb71a15cf8b515dc7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4632_HLSLOYBBINOCMGNP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads