hxxp://nancontrast[.]com/err[.]gif?

Analysis

max time kernel
64s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2023, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://nancontrast.com/err.gif?

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133259134098949602"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4528	chrome.exe
4528	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 536	4528	chrome.exe	81
PID 4528 wrote to memory of 536	4528	chrome.exe	81
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 2380	4528	chrome.exe	82
PID 4528 wrote to memory of 828	4528	chrome.exe	83
PID 4528 wrote to memory of 828	4528	chrome.exe	83
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84
PID 4528 wrote to memory of 2368	4528	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://nancontrast.com/err.gif?
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3e7b9758,0x7ffe3e7b9768,0x7ffe3e7b9778
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1812,i,864911325479471219,16759503134798769898,131072 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1812,i,864911325479471219,16759503134798769898,131072 /prefetch:8
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1812,i,864911325479471219,16759503134798769898,131072 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1812,i,864911325479471219,16759503134798769898,131072 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1812,i,864911325479471219,16759503134798769898,131072 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4480 --field-trial-handle=1812,i,864911325479471219,16759503134798769898,131072 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=1812,i,864911325479471219,16759503134798769898,131072 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1812,i,864911325479471219,16759503134798769898,131072 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1812,i,864911325479471219,16759503134798769898,131072 /prefetch:8
  2⤵
  PID:1628

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4c7cde08065ac39e0558dc2f78b1e38c

SHA1
61c73b2b8c6d0cb88bee55045fde9a37669240fe

SHA256
79892f1d6f1260109886c6256a5ce9cccfe2c5b4110701520116b7aa698d7fc9

SHA512
f2d31368405cd091ebb7c2800b35c109f4cb51babf82e8a140cbec1dfaf631d430fda41c3d02834f78cb5811b781dcaf7ab4c4fd1ed3cba25e6dec0b19b0582f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
882a2e110a0a16f9cecb42aa4c71282e

SHA1
3fca19909520f0afc65c63a77e9a8517cb545265

SHA256
57eb3dfbf83b0e160a09f5d1bde6704245998190787a915a00826a9527cfb080

SHA512
0c3a33fecb355abe3649c60c8b05caa99cafc87678582f87eaba606bb942a241401774f6d1b97cde6a604a04eb16870fdb30fb7cb829a14e94d8ddcf56016c43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
5aa2d66cdde4229c981e153920b11431

SHA1
cedb6040a3c26a4998bddaa6b74d3b464f5902c6

SHA256
d3233d9036f7e30c864854358a632a3e7ebba04d91936edaf38b8fc28432842b

SHA512
95638e4dacca87aac3b9d117844cf9e9fdec7b3a970031241da954e8812e3a6aaaecedd621fc762ca04dbf0db99ab5140637172c217d4a9da0527c54b831c94d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
42d3c275a69d6b749946c92de26afdc7

SHA1
49fd77e9d6a8a197245329a6b7066849e7735b27

SHA256
7ac422eab9945dcd6405c9524e5e15574f227889d7dd1d8b0b9f7f8969bf8cd6

SHA512
0ae4f19ae28b068075be936ca9dbd40f7dabb53279f6f1c9310a7070cd13d34eb946490a9ed95fd17013ba16071d44d966fa1ad349352102504e11d1b4219f78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit