hxxps://na4[.]documents[.]adobe[.]com/public/acceptGpsInvite?token=CBNCKBAAHBCAABAAJx8jcWXil3769Jp9OuzC_UqRAf0SZ-KK

Analysis

max time kernel
31s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://na4.documents.adobe.com/public/acceptGpsInvite?token=CBNCKBAAHBCAABAAJx8jcWXil3769Jp9OuzC_UqRAf0SZ-KK

Score

10^/10

adobe phishing

Malware Config

Signatures

Detected adobe phishing page
phishing adobe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133240657898844648"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

2836 chrome.exe
2836 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

2836 chrome.exe
2836 chrome.exe
2836 chrome.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2836 wrote to memory of 1204	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 1204	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 4576	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 100	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 100	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe
PID 2836 wrote to memory of 628	2836	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://na4.documents.adobe.com/public/acceptGpsInvite?token=CBNCKBAAHBCAABAAJx8jcWXil3769Jp9OuzC_UqRAf0SZ-KK
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6f2c9758,0x7fff6f2c9768,0x7fff6f2c9778
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1832,i,6753975021349483934,1901283512362987128,131072 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1832,i,6753975021349483934,1901283512362987128,131072 /prefetch:8
  2⤵
  PID:100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1832,i,6753975021349483934,1901283512362987128,131072 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3236 --field-trial-handle=1832,i,6753975021349483934,1901283512362987128,131072 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3208 --field-trial-handle=1832,i,6753975021349483934,1901283512362987128,131072 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4616 --field-trial-handle=1832,i,6753975021349483934,1901283512362987128,131072 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5632 --field-trial-handle=1832,i,6753975021349483934,1901283512362987128,131072 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 --field-trial-handle=1832,i,6753975021349483934,1901283512362987128,131072 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 --field-trial-handle=1832,i,6753975021349483934,1901283512362987128,131072 /prefetch:8
  2⤵
  PID:1804

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
553aa743ae73150644b688c293fc4a39

SHA1
d095fad5133c3ee068ed6b7cc009d1ed1c0b14e2

SHA256
89761267fbd5b2a9c4116c2362637a437cdcbd7ee4db2192681b062054b3fb57

SHA512
bf0b166395b6134ecf62bf6e9fa0e49b98a6ccbd42cf877f18e5dc0f6417ec30628a49f395ef9918afa236f37935ac04b63bd5f87b8f3e07f20e8e66b3c5ad16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
59c8907d896dcfd8c7ee1ccf80602e18

SHA1
932c7a99d7a2b851f0393b82a33e6f85864f78e3

SHA256
e712e76523b2a95ca9295ef7ebd89bc5d0cce474f7a0e71123745512464d5e94

SHA512
be4385aeee3c4a26cfeedb5e02fa6b81f66d9e6dd67d6f73375bedb2b0f59e9bc61f5693dc6ff042846a23ecc769a4e03fd1eee3a11a30663b6965eedb149763

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
66112574e21cd1bfbb490584e2bb1c33

SHA1
8b10667dc77cd49f7f01d5f1ead2a3506860a233

SHA256
1b922d24a059ac507d4392eacb3836a6812dbfda7bfe49a05da02b221f7302fb

SHA512
a5df6e1055f68175aa91aed1937d58ec4a93df64d87bc62839aa88b31046257484791317116254d1418ce478ba924968393ff0fc2023334c235963ea9bb5b84b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
145KB

MD5
47372910188ccc46dfb2d428e72318f8

SHA1
ffe3bc32fb05bbab570895a2eacfb966d5943401

SHA256
317f36d39782658f7f5b39b57240ecb4ac35f9a4c28e4e901a2f7dabf17c4ad7

SHA512
d298782cb2d0b64664a89fd4014733d397eee912f241d19b41ecbcbed48d47d5beeb3a6040a1b592dd1554c17ecd73ca9932d044da3aa6b5cb900c5c904078dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_2836_NHJZOXTXDHVEQFYN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit