hxxps://wicovers[.]neocities[.]org

Resubmissions

01/04/2023, 08:31

230401-keytjsgh86 4

01/04/2023, 08:27

230401-kcxtgagh78 1

Analysis

max time kernel
16s
max time network
145s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
01/04/2023, 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wicovers.neocities.org

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1368	chrome.exe
1368	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeShutdownPrivilege	1368	chrome.exe
Token: 33	2632	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2632	AUDIODG.EXE
Token: 33	2632	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2632	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1552	1368	chrome.exe	28
PID 1368 wrote to memory of 1552	1368	chrome.exe	28
PID 1368 wrote to memory of 1552	1368	chrome.exe	28
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 1948	1368	chrome.exe	30
PID 1368 wrote to memory of 336	1368	chrome.exe	31
PID 1368 wrote to memory of 336	1368	chrome.exe	31
PID 1368 wrote to memory of 336	1368	chrome.exe	31
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32
PID 1368 wrote to memory of 1140	1368	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://wicovers.neocities.org
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef77d9758,0x7fef77d9768,0x7fef77d9778
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1232,i,10362695293268066112,7847409424873607567,131072 /prefetch:2
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 --field-trial-handle=1232,i,10362695293268066112,7847409424873607567,131072 /prefetch:8
  2⤵
  PID:336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 --field-trial-handle=1232,i,10362695293268066112,7847409424873607567,131072 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2172 --field-trial-handle=1232,i,10362695293268066112,7847409424873607567,131072 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2180 --field-trial-handle=1232,i,10362695293268066112,7847409424873607567,131072 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1412 --field-trial-handle=1232,i,10362695293268066112,7847409424873607567,131072 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1104 --field-trial-handle=1232,i,10362695293268066112,7847409424873607567,131072 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4084 --field-trial-handle=1232,i,10362695293268066112,7847409424873607567,131072 /prefetch:8
  2⤵
  PID:2424

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:924

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0abd72960b2c48262b017ea64bd131e8

SHA1
ab60ba746d6460631b192a3e91dcfdb036e4bcde

SHA256
36baeef100edc189042910ceee7a1747b74b9216a24d0ec312bea9eb1ff45dd0

SHA512
af63a385544eaa48f77e828529868be07291ce6af05d7bc285c0121f0566541dea4f2e13f5223b0917d7a294280b927b968a69df65dd289744083dfd825f9072

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube-nocookie.com_0.indexeddb.leveldb\CURRENT~RF6c4ae6.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
da5dfe833f25d221847d298ebbdd1052

SHA1
98e55d6240c13aa07a3247ec10a9ac8ff43fbe1c

SHA256
b5916201093a0a00c650abc477a3774dc110912e84d8e351675e1c82947c34c6

SHA512
ca7f2bbd399eba9582b72aaf1a34c9a0fabfbd8f9f0913c974e2041f8ae303b37d8d4d87e988f4c43f3de879dbbf1f6bd1ac4c717d110cf8bcee1bc47a84de3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
8dfabf9edb585ddab37a7311fb178869

SHA1
f03f9ed7de48bf3ac6196c4637638c3728ee95b4

SHA256
db54745cdf169a39edd6c467a27fa809c134ddb08f9a4e83263451af836b157b

SHA512
416c4122f72f2257f1fc8c2ea0364ffb8f59c748806f61e4e40ed2a68055cea35bcc34853f09db1920af1b3eeddd4962e44fd6f3fa6b7dc4a65951e7d14d7e89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
d6d42dec1ef81afadd5b87c53021927f

SHA1
9cc277b51b180a726a1f559a5a138b82510d68ff

SHA256
9b5c1317a127dce884d94017bf01aac930665671110a93b8f0dc9183a9b1915e

SHA512
ff1b84154305b431b172b6b5dbdc78285cdc14f9cb407bf6f5554fa433b03caa0488a006023d8375df454350e4132256d5220205756e9a376cf272dbe37b378d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\edd2c03a-2205-4787-84cc-c84538d10312.tmp

Filesize
4KB

MD5
c6aa7543813265fc84b63c86473e8126

SHA1
613b754d3e14410a8b3810353de1d0c5c742e5ae

SHA256
0f63e32e8031c9f50e98e849b17949308aa5fbea74acc7f397c6c98542d236e4

SHA512
50da237f276923a2e627c2648524ff84f00757bca23c7520d9de46335146af8d4b802d83c20773c1bc97f9410e50e5a4aa2529a2846c8a7b96e689b1a5a7055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CB4.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit