hxxps://raw[.]githubusercontent[.]com

Analysis

max time kernel
300s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2023 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://raw.githubusercontent.com

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133265547903054576"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2500	chrome.exe
2500	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4144	2276	chrome.exe	83
PID 2276 wrote to memory of 4144	2276	chrome.exe	83
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 4768	2276	chrome.exe	84
PID 2276 wrote to memory of 2792	2276	chrome.exe	85
PID 2276 wrote to memory of 2792	2276	chrome.exe	85
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86
PID 2276 wrote to memory of 2304	2276	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://raw.githubusercontent.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7b0a9758,0x7ffa7b0a9768,0x7ffa7b0a9778
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3264 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3240 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4556 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3484 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5248 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3460 --field-trial-handle=1812,i,11821042894128337344,13007803419896329210,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
6c398d4661b338ae225d97d2f250dca6

SHA1
6193e87327023012efb1d249befae0f34d0bc236

SHA256
762f43ecb1a7449ea6c5bb92533f94e01436a8a53ca29bda0ca1d34e4070bde3

SHA512
2dc1de8f37d3ebcad8c12491cbb6d602ddf5634dddaba40b1cbaf9479252378df7fd86263170368391c33c9baf05e1c5ece09ad7c4fc1e41546f8e3e2e68695c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\77365d5d-7153-4f94-af3b-c8dbc02e5fa3.tmp

Filesize
1KB

MD5
261f348ffd4fdf4ca984d0f448f57760

SHA1
28f858428ab488c2d512880dce0d4a95fe5d6281

SHA256
959f98500f3d74667121d38c98575812749d95627d87cf44627ce64a302d2193

SHA512
738cd6321a38ad48de71c4128899db155b28d4613766f8559949e75bb4654452142aed0efef81064ac9b7cbbfffaba401d644f15a60295e2a2f50a8f7320b25d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
cb75c8c662dbbca5bfde65784ecefb5d

SHA1
b04c0aa955d27aafdc387d84661ae983e315d67f

SHA256
eb57d182faf80cf3d65e1551430de6ac5b7fe05e8157c91d50d920debd14fdd0

SHA512
000b156feb76c6a408da49e99216a191246eaa54aa5dd55199563371dc1d7f07c3294560cc99296e68395ebc37185bb12c11a713c7a5ef8c63a7e6cb95d125bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0de78d339fb1648bb6437d93a2fd997c

SHA1
996dfd118ddff8da00f575ca9dbb2f716e9e95fc

SHA256
88fccfbdeb628a125de0326a795f446ebfc49523bf9f403f6119320be500a447

SHA512
aaf26d2a21c47d79b7f70c3e1480d19246f8770ae5d75afb84c5b8405b8280ab0b8d891267de883f2b6bfb0c80ae4226f2949d0d0321f570fd9596a3ccd66719

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
8dc9c47269828525ee13f9807cea0f72

SHA1
1f5853307f72625ac23ae2114d31415943041c09

SHA256
3862a17c9e2b727c6d9726dda921e304d415c27ecb2f30c6f9110763d4d1010f

SHA512
088c265e87ae28dfe0542a98ac7e5c323c5b93bdc1b35cfb1f42fb24e996fb0a6c1b45db451ef8339c41b05e242b160013b63ca55b9adb80ac365b5d5ce98900

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
200KB

MD5
3ac7530999688121bc368d036be5968c

SHA1
3fc48324a4514af546456b8f1d980d63c6e3b09a

SHA256
c34613107f2735ef50221d7242f6317e6461aa444c8da6a6c903094c59b549c8

SHA512
c172227474131ea417b7404887b470f8a1081ced531603dfcda6e4a01fd744f78ce3b164cf399d9d1ed456c5e9eb7010e826574e3f777b9c35dce8c0b9480360

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit