2bea14dbcf68b3c410b866304368681b95eecc5348af02a368cba89bd77e2f6e

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2023, 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RemittanceAdvice.html
Size

17KB
MD5

b1cf6e1c60d5bc7943edb75345e48c0b
SHA1

471fe79fc41fdbfaa82e05293a20d1a8889f8bf8
SHA256

2bea14dbcf68b3c410b866304368681b95eecc5348af02a368cba89bd77e2f6e
SHA512

3b47dacd9b63be08dd89f871edfc11a607bedccfbeff8866eef8502a8275f9b15c9b3e90eea2d7b871f6f24f1cd62aa1fd1734083c64c767f3ae0827867eaae2
SSDEEP

192:NITtvQHwf8giZPwIClK2sFiKmucuQCAV3RERja4MOVRB3xM9IfkeILxoIxaec:NI+gePvtcuQC1jFL8enIxxc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133263168020672525"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
544	chrome.exe
544	chrome.exe
4648	chrome.exe
4648	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
544	chrome.exe
544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 4772	544	chrome.exe	84
PID 544 wrote to memory of 4772	544	chrome.exe	84
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 4424	544	chrome.exe	85
PID 544 wrote to memory of 2004	544	chrome.exe	86
PID 544 wrote to memory of 2004	544	chrome.exe	86
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87
PID 544 wrote to memory of 3444	544	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\RemittanceAdvice.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9faf9758,0x7ffb9faf9768,0x7ffb9faf9778
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1812,i,2506165579150323819,8836298389190189786,131072 /prefetch:2
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,2506165579150323819,8836298389190189786,131072 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1812,i,2506165579150323819,8836298389190189786,131072 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3208 --field-trial-handle=1812,i,2506165579150323819,8836298389190189786,131072 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3220 --field-trial-handle=1812,i,2506165579150323819,8836298389190189786,131072 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1812,i,2506165579150323819,8836298389190189786,131072 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5036 --field-trial-handle=1812,i,2506165579150323819,8836298389190189786,131072 /prefetch:8
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1812,i,2506165579150323819,8836298389190189786,131072 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2552 --field-trial-handle=1812,i,2506165579150323819,8836298389190189786,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
841B

MD5
87141adbe31ac91b41310c560f4dd6ce

SHA1
3b14dafe7c58dc425f12c9b0441a7bfa74db880f

SHA256
1667bfa0b26b05b5f2d0e57c9d19255eb473f951572e0542cccbc41fde97cc5f

SHA512
3541fa3a3b0ecd1872aa835e72139efd66600639186c71f779dbefcb6c277cb369f0b52471e7ace54a73308455e190000e178b1b0d97950326ac8ccd3ae9e474

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
959B

MD5
ff63be8857a5070b6c2df8e77e414f86

SHA1
6c3a07733ab7c3ea91baca4cb6ee82badb2bf9c5

SHA256
db75918be0498ea8f5cb552abfe58eec89eec444ed68c94c591374a2706eefbf

SHA512
8ef6b310f1889be99e2c6c66fafd18719400e879ffa33ce0034a91653608489c1543338139378be3c8eb67b3f0d59f6ed4ed307eda008ab8c265ae8caca303e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9037cdd97c800ade294542ee6bb029c2

SHA1
30b59cd039852241cef9e35bbd68894ec861b245

SHA256
2d313122d8ca4f21e458b836d87951c3becc6aa5a267eeb3e17c0391bee5cdce

SHA512
b1598f9a1f181ab7cef8ecf656a66e864c0ccddfc38bb15cd11f6e88ee754c25c38701df431c527d655e0b2cac5b8ba261fa8a28baf5e0dfb1b1bfa7f4980149

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c938a6fa6bfe83224a928770314c30f2

SHA1
8f1316a4221294f2030e581fcaeecdb16a3100fa

SHA256
b5965f075b12c2553cc4d7cd3dd2e12dc4ebe135545ed0c4bfc2d8326e11bc00

SHA512
c1a1f4b863c0979e9c335771558253602c620e3d42803163f53efb8603e79c21756e3682507ddb3820cf53efdec55e363ff8419cf3c84d051cc08ac3b272b2d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
8f5e78f4254bdc93cd3dfeadceba23dc

SHA1
5f9021ad97fe9e463fde590a66a30e8ab2197d39

SHA256
800fcbc12813090ba77b071155eb679aea46b80828781042c9e9fa8e53a26ced

SHA512
b426716adf718ee2b7c17913e97e017c4b23626ea30fc4b7bef82c27dc3d4849a56bb09fb4c33d3e8d4a4c3dffa9edba784e2205ab111d8d9686a6215b2c1503

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
07961430bf23f3762b38ac187e2bc207

SHA1
896eb74425e30559963946b97912c3e80bea4a28

SHA256
b7dc8e690ca18d5a49ecd72265d545c2c2968f24bcddbdef3c151564582ec23a

SHA512
90c466e92d8afa462e4eeb7408b5f918f0eabcc568341c2f388651ea5564c1f2589d0d178a6b1b0f4a270092be870ab18fabf9daceee766c3ddbccc3b870dd19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
98e06c11a4e342168128cbb9b8249adf

SHA1
e843365f8c29ab92dda1f98ba601344c4cd68952

SHA256
b2e59816eb708cc1095d4ad9d8b18ce66574946f08a994231fb2905c891b23bb

SHA512
69006cb91f1ad390e0bb67b7c9704db395689533da8050e0fd20f3f01c87293073d4f58027310cba3783101a86e5c9d9ce23011f13e5dfc1114edc05ad3858e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit