hxxps://ipfs[.]io/ipfs/QmYvUoMuXQJY5PkGH7sc2EA8ERYYnKCyJkWL77gkKeRCA2#orf[.]dom@scangl[.]com

Analysis

max time kernel
30s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2023, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ipfs.io/ipfs/QmYvUoMuXQJY5PkGH7sc2EA8ERYYnKCyJkWL77gkKeRCA2#[email protected]
Sample230322-pc184sgf86

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133239643248350983"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4728	4632	chrome.exe	86
PID 4632 wrote to memory of 4728	4632	chrome.exe	86
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 4784	4632	chrome.exe	87
PID 4632 wrote to memory of 3760	4632	chrome.exe	88
PID 4632 wrote to memory of 3760	4632	chrome.exe	88
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89
PID 4632 wrote to memory of 2172	4632	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://ipfs.io/ipfs/QmYvUoMuXQJY5PkGH7sc2EA8ERYYnKCyJkWL77gkKeRCA2#[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84e699758,0x7ff84e699768,0x7ff84e699778
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1792 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3224 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3228 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5284 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 --field-trial-handle=1808,i,14696334338341770095,7846372668549914482,131072 /prefetch:8
  2⤵
  PID:752

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 0d278815cf66a030452a870253b16215f213407e43f67e602c15b6cca387b1e3
MD5 909bd36bace309dd66ea7c0580f0beb8
SHA1 44ce836092894c0685aeeaedcfceed5271ec129e
SHA512 2f5c658af78ae643dd4802f72cb5ea02aded767eeff3c4b56273dbbdafddac4b5f22f54003f28aaf9d1e1401bc6ad998f659aa7439919d18de7c25261ccfc933
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 538B
SHA256 7ca1f5d9b6d7513ab9c49fca4a69d24c48affc9e47020e4b3404ec1ecf35d68e
MD5 5737700b21ed8498439b3d09b5540cb1
SHA1 a2fce37bb09688c971d5098e3bc3bbfc40cac435
SHA512 dd56f37a28f57a1205dbd077909e2e0e6625e80fa2bec7fff94c571af8c7a22ebfdebc93ed292f13482a94ca7c83c1655f1a7fff662cab6c181b35d9ee796681
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 ca2446cbe1d76b1ecbc86d227661b5f59ac33cf0834eb9e094a57d2a62f901c4
MD5 1b1ef1caf3b0d6caba67f64fc4845c24
SHA1 9627995d28b3e09dc467bc0f28dd491c2b948080
SHA512 0f7a40b0a345dc259b4aa87954ffd8127e96480f494ffeb77f1fbc30c60c7970ad1109141ed856fb8adf225128e16fb255f4d38c6a850a501cdf27841cb102da
SSDEEP 96:2HrcXZgsn8KIDWL8iZRy7Di+6Msmde9kb1bOUHDjVhYtjEsXt0/cg2Vup:2LcJ4S8syy+FAkbRotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 2963fb59ec0c3bc8eed19d1e37a991b01d02c9ce5610439848b5a146bde9d196
MD5 0e59b29d6c093fd1632d787a7176df1c
SHA1 b4d85840b5ed4f1330c37907c62981970d3088d6
SHA512 328f57694848b21b7192dff9a481ef1640736853602d5269fe348a62f06cd8f0cf0fd6775bd0079d41bbc50ccd4edb96b1b8e7123c3ffaba99c611290706c061
SSDEEP 384:sGLALPPX21kXqKf/pUZNCgVLH2HfkBrU7HG0g6ft1P:jLALH21kXqKf/pUZNCgVLH2Hf2rULG6b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 144KB
SHA256 deaa723516354669c1198745f853b4910ff1ab09efd9248f35a8e8d294e66546
MD5 d407209239ec329a7b750ac862e40c6e
SHA1 9e621a6f94ace7d34d4fc783f5ad6dc7882fdba9
SHA512 32b24fe159d47e3a78fd9fe18c82b7671df57577a159b5dfafc9feeef4bbc3b8d85f5d9ba4a87720c188f1b8798d18f8e6417e14efd8173fb71a15cf8b515dc7
SSDEEP 3072:CGeZ3mNW/+lLSO3E0kFsqh0H/Q/6Zp/viVwg0GOM7VzV:CRlmw/wW7Dq4/S/viVLjhR
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download