hxxp://o365mail[.]accountmangement[.]cloud/

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://o365mail.accountmangement.cloud/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133249464038180543"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
2892	chrome.exe
2892	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3820	4704	chrome.exe	84
PID 4704 wrote to memory of 3820	4704	chrome.exe	84
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 3204	4704	chrome.exe	85
PID 4704 wrote to memory of 4340	4704	chrome.exe	86
PID 4704 wrote to memory of 4340	4704	chrome.exe	86
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87
PID 4704 wrote to memory of 2808	4704	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://o365mail.accountmangement.cloud/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabd1f9758,0x7ffabd1f9768,0x7ffabd1f9778
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1812,i,639814715105531454,12433060847125071135,131072 /prefetch:2
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,639814715105531454,12433060847125071135,131072 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1812,i,639814715105531454,12433060847125071135,131072 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1812,i,639814715105531454,12433060847125071135,131072 /prefetch:1
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1812,i,639814715105531454,12433060847125071135,131072 /prefetch:1
  2⤵
  PID:324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1812,i,639814715105531454,12433060847125071135,131072 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1812,i,639814715105531454,12433060847125071135,131072 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1812,i,639814715105531454,12433060847125071135,131072 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2320 --field-trial-handle=1812,i,639814715105531454,12433060847125071135,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
3daba355d44cbc21aaf48d05c1d2a8f8

SHA1
5f75809d9acfdaea0e7295bc267fa1e88032d326

SHA256
86d98f4d1e16d6dca848df3b2885871825c632f32339efbe068403d1cfb9e518

SHA512
278bfad565e885cbbef6b8c46cad7f26fa23cabe9b758c57471fdd8d962c7414261280d5c23bc80fd9b2928650e9e328f088d2aa03bd12ff08fc2ad980d511a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
ee2b63fba8f5208ca93f8c46804b027b

SHA1
ce9835d58ed0f46eea0eb5a5805af2fbba73e4e5

SHA256
98b2439d69faa92dcbbecb3a4bb2b653fbb6323dcf32c687ce092f23639199cc

SHA512
2de0cdc28141c9b92517ddef69155d5798447d4b8cf9322580bc637e6752138577c87edae7d351fced04e47e59e0924612b58d397a59d3d2239d555676493055

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e8655ccc4a76d8c254148f324f67e559

SHA1
cc449aaddd9e80c1fc196676bd3251813b3a5d68

SHA256
49b8b8c3217edc7895eb58a5c46099993ec5431f855b2d0970e5f2554937fd33

SHA512
2e0289b7e3aa2371485258b42f6ec8797bbcef8b37210f7abc44845f48cd83a02636f0f5c88395e076ffa4d538ecfe40971634d55b8cd3697987968ea7ae1b09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
6aaa821b6c4662bc604706d35dd0cbc1

SHA1
e40246855091399e7ed62b185fe098bc5c1194b3

SHA256
72d6fd37aef19589211645c57a19192dad4ee842cab29b7cc6dacf45dc74bb32

SHA512
0b6c9129bb1172054b78569cb4d37bfd46c1201ccf57f62c0e5d8a13b1303e7177018de51890016bd997edfff6c8e66b748a7bb910efa03b85d5eac1a8b14733

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
64302d0bfd50503182b95b9916c8c976

SHA1
944e282be79e591b27427379847c63e7a9e4c84e

SHA256
736070570cbef18c6b0743f8926245733c3a8264131a112eca3adea2cb550c2b

SHA512
46666566a4c5e9f1243f9db2eb7bfd5768161d5e0034558dbbbc83ad0efd649a200d601357b8bca360a9365681b557335a154bdd6a34219bc28aec867ea159ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit