abadfba5d8cf8812faeb9b5186e18572be8ea2fc1bdba988d72377a9ad04a38c

Analysis

max time kernel
18s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2023, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ATT42345678.html
Size

2KB
MD5

06525535ad965bfb0772ecac13bf1001
SHA1

86ff6440aa29a0c4ad6fb262c86d7a50ad615131
SHA256

abadfba5d8cf8812faeb9b5186e18572be8ea2fc1bdba988d72377a9ad04a38c
SHA512

e437674994c783f48340131a5e1099a2f1f774c18b4c1e9f86411bc1f88db09ac69898b2e433283eca29ad3f9946e8988e8c5265075382a1e8133a7c1c3c9fce

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133241199406317832"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2348	chrome.exe
2348	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2348	chrome.exe
2348	chrome.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2364	2348	chrome.exe	86
PID 2348 wrote to memory of 2364	2348	chrome.exe	86
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 216	2348	chrome.exe	87
PID 2348 wrote to memory of 2076	2348	chrome.exe	88
PID 2348 wrote to memory of 2076	2348	chrome.exe	88
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89
PID 2348 wrote to memory of 3316	2348	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\ATT42345678.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd94889758,0x7ffd94889768,0x7ffd94889778
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1812,i,17417494516355237427,13298623923852889354,131072 /prefetch:2
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1812,i,17417494516355237427,13298623923852889354,131072 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1268 --field-trial-handle=1812,i,17417494516355237427,13298623923852889354,131072 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1812,i,17417494516355237427,13298623923852889354,131072 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1812,i,17417494516355237427,13298623923852889354,131072 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1812,i,17417494516355237427,13298623923852889354,131072 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5016 --field-trial-handle=1812,i,17417494516355237427,13298623923852889354,131072 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1812,i,17417494516355237427,13298623923852889354,131072 /prefetch:8
  2⤵
  PID:4168

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3593925b-65a3-4bdf-8358-aea2c6ae63ec.tmp

Filesize
15KB

MD5
aa88682e61948ab594a2d4bc7c8bf880

SHA1
7966087c2670f27ac615653b1a5c58a72ab5e4a1

SHA256
8b832f56f3d9361a9b658b47e13c8f9a4dde494139ae3c30992a45dc18da9d98

SHA512
a3de2fdfa672cc0d80656d077d8e843503ca8bc3298b9a579956e28aea4c158afcb1973fca8240aca71d13fd6ea1a58b001eaa66b0cc23b386fd87de6e91a707

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3e1db3199b495c1e691ee8993beadd27

SHA1
879f908ac10a40f445974ac9fcdb33d0aa5339c9

SHA256
b2bbebccd649fe1d95a46daec27b19917d8c9ab18cf00776607e8d336c4d424e

SHA512
fd0cab75d48f0bd2e03fb8f314f85ddb7d86fb8defd06200f784911724a28cf1a45e00471a10985dab5e997e753ef2737c3c4a831b18950e28473d01179ce4fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
144KB

MD5
9d538e6e9e04797bcd42766bd13111a0

SHA1
2e1d0b3b95e19bd751e1bd855ca52990b712ba8f

SHA256
3e8148a7d0451123930a5707d51c368bfbf2cf0b6460d8ac9903bcd17eb32f13

SHA512
04bfbe3c58dc21ae4b9e2922f1f927c0a6e0da5d9b6fb58b38c30c4d1d65bd1ca89958b5bc8553d500b2f6d868915a1ca139eb25a71c1943978e342948a0a98d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit