hxxps://info[.]sparkpost[.]com/f/a/DLcb5QB6tu7ltVxakzRXkg~~/AAAAfQA~/RgRl-ugtP0SFaHR0cHM6Ly93d3cuYm94YmUuY29tL3RjX3NlcmlhbD01ODgxOTMzNDg1MiZ0Y19yYW5kPTIyMDUwMzAxMCZ1dG1fc291cmNlPXN0ZiZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1DTl9GSVJTVEMmdXRtX2NvbnRlbnQ9MDA4JlcDc3BjQgpkCi1jGGQW-fDDUhZzYWxhdC5zaGFmaUBpbi5hYmIuY29tWAQAAA0w

General

Target

https://info.sparkpost.com/f/a/DLcb5QB6tu7ltVxakzRXkg~~/AAAAfQA~/RgRl-ugtP0SFaHR0cHM6Ly93d3cuYm94YmUuY29tL3RjX3NlcmlhbD01ODgxOTMzNDg1MiZ0Y19yYW5kPTIyMDUwMzAxMCZ1dG1fc291cmNlPXN0ZiZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1DTl9GSVJTVEMmdXRtX2NvbnRlbnQ9MDA4JlcDc3BjQgpkCi1jGGQW-fDDUhZzYWxhdC5zaGFmaUBpbi5hYmIuY29tWAQAAA0w

Score

5^/10

google phishing

Malware Config

Signatures

Detected potential entity reuse from brand google.
phishing google

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133239790052863947"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3648 chrome.exe
3648 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

3648 chrome.exe
3648 chrome.exe
3648 chrome.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe
Token: SeShutdownPrivilege	3648	chrome.exe
Token: SeCreatePagefilePrivilege	3648	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe
3648	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3648 wrote to memory of 3616	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 3616	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 2204	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4428	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4428	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe
PID 3648 wrote to memory of 4540	3648	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://info.sparkpost.com/f/a/DLcb5QB6tu7ltVxakzRXkg~~/AAAAfQA~/RgRl-ugtP0SFaHR0cHM6Ly93d3cuYm94YmUuY29tL3RjX3NlcmlhbD01ODgxOTMzNDg1MiZ0Y19yYW5kPTIyMDUwMzAxMCZ1dG1fc291cmNlPXN0ZiZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1DTl9GSVJTVEMmdXRtX2NvbnRlbnQ9MDA4JlcDc3BjQgpkCi1jGGQW-fDDUhZzYWxhdC5zaGFmaUBpbi5hYmIuY29tWAQAAA0w
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd253f9758,0x7ffd253f9768,0x7ffd253f9778
2⤵
PID:3616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 --field-trial-handle=1744,i,11149687217917515049,11991060563172368811,131072 /prefetch:8
2⤵
PID:4428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1744,i,11149687217917515049,11991060563172368811,131072 /prefetch:2
2⤵
PID:2204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1744,i,11149687217917515049,11991060563172368811,131072 /prefetch:8
2⤵
PID:4540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1744,i,11149687217917515049,11991060563172368811,131072 /prefetch:1
2⤵
PID:4844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1744,i,11149687217917515049,11991060563172368811,131072 /prefetch:1
2⤵
PID:4836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4464 --field-trial-handle=1744,i,11149687217917515049,11991060563172368811,131072 /prefetch:1
2⤵
PID:3952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1744,i,11149687217917515049,11991060563172368811,131072 /prefetch:8
2⤵
PID:3224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4964 --field-trial-handle=1744,i,11149687217917515049,11991060563172368811,131072 /prefetch:8
2⤵
PID:3928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1744,i,11149687217917515049,11991060563172368811,131072 /prefetch:8
2⤵
PID:4876

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
682126d24c9ff7889d0183f576442e6b

SHA1
e05f20fd110a42db40d5f4ea93d7c5c64e44a600

SHA256
a4799184d2860bb58256fa6ea40bbde062ec23cfc57eaceea57642c8664479d1

SHA512
42f0564b8333f6c2ced0f04472d4ad307b8bbd000c2a7780478dced082523e1f85caf75067edc5bea48b4dda3d33726a7903e9fedf0399b1129debc71d013a7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
afc01978055b5eef681fed585190670a

SHA1
9754bd675a0e1a4ca3ee1a02c82c9155d7e138fd

SHA256
5da8020bc66ddeab07b41e7b8a3defe1a2dcc23dfa0d548bc24e396bc717cc46

SHA512
c4690350f3c20e6824c86fd129c15a7de6e2062e03a651b7ba36c13ccbf93d64c217eeb59279534e7d1b887a0b4a6077540c28f88dc2b08a486bbae127828c88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
144KB

MD5
90b552a3821ac3f3c8ca5f43d2a58220

SHA1
4a2b79f2574742588f170299351cae480f4339e0

SHA256
2d69ffc0be08f5b620fbce007e081a63b56f054b08f71ab1b77df012d88c79ae

SHA512
8d64976a064ae1ec34b455dc9eba8b6ac3db7adfb075f01e561c59de342abb1465d50d79ca35c9505fdc653782c69f8ea9f1641f06c8e400b2c208982eac3cbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads