hxxps://aawesgrdhtyjkguawfhfngdbfrsdvzxfgctyhgujgmhngdfsddfghhaa72[.]s3[.]us-east-1[.]amazonaws[.]com/8sdgfrdsvfbdvxf[.]html?wnkstain@turdbreath[.]com-reminder-licence-services[.]renewed[.]yvnxdrjvmvdrn3adnkz8%5bUK673242054531%5d-%5b13242054-3/29/2023%2011[:]07[:]24%20AM

General

Target

https://aawesgrdhtyjkguawfhfngdbfrsdvzxfgctyhgujgmhngdfsddfghhaa72.s3.us-east-1.amazonaws.com/8sdgfrdsvfbdvxf.html?wnkstain@turdbreath.com-reminder-licence-services.renewed.yvnxdrjvmvdrn3adnkz8%5bUK673242054531%5d-%5b13242054-3/29/2023%2011:07:24%20AM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133245716093743248"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

1720 chrome.exe
1720 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

1720 chrome.exe
1720 chrome.exe
1720 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1720 wrote to memory of 1844	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1844	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 3332	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1384	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1384	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe
PID 1720 wrote to memory of 1972	1720	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://aawesgrdhtyjkguawfhfngdbfrsdvzxfgctyhgujgmhngdfsddfghhaa72.s3.us-east-1.amazonaws.com/8sdgfrdsvfbdvxf.html?wnkstain@turdbreath.com-reminder-licence-services.renewed.yvnxdrjvmvdrn3adnkz8%5bUK673242054531%5d-%5b13242054-3/29/2023%2011:07:24%20AM
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f08d9758,0x7ff8f08d9768,0x7ff8f08d9778
2⤵
PID:1844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1784,i,6413526125327497600,12255042669423272977,131072 /prefetch:2
2⤵
PID:3332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1784,i,6413526125327497600,12255042669423272977,131072 /prefetch:8
2⤵
PID:1384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1784,i,6413526125327497600,12255042669423272977,131072 /prefetch:8
2⤵
PID:1972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1784,i,6413526125327497600,12255042669423272977,131072 /prefetch:1
2⤵
PID:3200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1784,i,6413526125327497600,12255042669423272977,131072 /prefetch:1
2⤵
PID:2672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4556 --field-trial-handle=1784,i,6413526125327497600,12255042669423272977,131072 /prefetch:1
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 --field-trial-handle=1784,i,6413526125327497600,12255042669423272977,131072 /prefetch:8
2⤵
PID:4876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5092 --field-trial-handle=1784,i,6413526125327497600,12255042669423272977,131072 /prefetch:8
2⤵
PID:4072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1784,i,6413526125327497600,12255042669423272977,131072 /prefetch:8
2⤵
PID:4100

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
965B

MD5
74717b36710306d08117b3f86b92ac9b

SHA1
ad10e446b06c75d6f77c9a511b10384d38c10914

SHA256
00445291029f24e893796ee1239630baa891263136e8fd3596b5d82bd37770ef

SHA512
561183f9b5219128794bd47efb37f7a61a364becd0b8194537afc4a39ada415c71a8d9ee433f897627f24191d7e91f15effb3d15bd74f760930032dced13f83b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
0b177a5a91676e48cd83071ab9f0d97d

SHA1
fdb2b0a6033afb74f05013e34aaf8ca4fbc0df95

SHA256
6b7848059f90a1c4303932c0f2427160f18a166a2551c34f9a8b31d6b1c0d834

SHA512
ca74c999a4879cdd78205196453081d84122f5e68bc226405027e5695581460ba994beab7663073e068aab5a1159745c8e585c7f9547bf4fd0b4ca3d5fc3a4c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f592145bb6a06251cfba932b77e57831

SHA1
47b9c1039b673480fe7da0fb27820ec6e3af17c7

SHA256
ff34fa9dfdbc7f5b0656f74bc72a095f8fee7200e4bbefce880c76d8b164a21b

SHA512
531fd2b9548001a600f47868075dfc08d7e7e226e6fb11a4e6749f33d7107e9e6814094a8dfc15ad086b9c193eebe1b84977a5a71fb9c5c92a979f98c8028b41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
dfb8d14bd0089295b0129f0a9f06ae22

SHA1
4f0959625f170fcc2ae99defb1ab01159fe00013

SHA256
709e9fb75befd2c9accea489f3abcf5f0b7e52c1a41278f5af2ae91565e08b5b

SHA512
c6c14a00e229a2de1e136ef18d1b9c76a656cd11f58a2a5fe5af261426ad34c10a8180c3b0a210c4d38954d4a9745a05799b0cfd0cb08c5d455d62d6492a2e68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
144KB

MD5
cbc8ea65d51c12d4e65697a84166e595

SHA1
01e0588284b9fa384473d7708316bc4aab2671f2

SHA256
8348d8d644a88d82572dee8a1d57ed937ef8d46731f8c5901fe8cc1a023626ff

SHA512
cebdc633b6742f9e614e0380bbac0644c3550f86e37df93cc141eafb6bada0df679bc1a1990839d094d044efde6470a3786e97f1cb9b4b2d0ec137e59b2c77d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_1720_WDTCEUENZYXNVRON

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads