hxxps://l[.]info16[.]citi[.]com/rts/go2[.]aspx?h=4009490&tp=i-1NGB-Q4L-lWT-C1jVeU-1r-3KyZzS-1c-C1fuSq-l8roiBjasA-NupOi&x=Dcccdnnewq[.]gorettibucaramanga[.]edu[.]co/alk/dcccd[.]edu/dGdpYnNvbkBkY2NjZC5lZHU=

Analysis

max time kernel
367s
max time network
370s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://l.info16.citi.com/rts/go2.aspx?h=4009490&tp=i-1NGB-Q4L-lWT-C1jVeU-1r-3KyZzS-1c-C1fuSq-l8roiBjasA-NupOi&x=Dcccdnnewq.gorettibucaramanga.edu.co/alk/dcccd.edu/dGdpYnNvbkBkY2NjZC5lZHU=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133277050507247824"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
632	chrome.exe
632	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe
Token: SeShutdownPrivilege	632	chrome.exe
Token: SeCreatePagefilePrivilege	632	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3260	632	chrome.exe	84
PID 632 wrote to memory of 3260	632	chrome.exe	84
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3284	632	chrome.exe	85
PID 632 wrote to memory of 3380	632	chrome.exe	86
PID 632 wrote to memory of 3380	632	chrome.exe	86
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87
PID 632 wrote to memory of 1224	632	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://l.info16.citi.com/rts/go2.aspx?h=4009490&tp=i-1NGB-Q4L-lWT-C1jVeU-1r-3KyZzS-1c-C1fuSq-l8roiBjasA-NupOi&x=Dcccdnnewq.gorettibucaramanga.edu.co/alk/dcccd.edu/dGdpYnNvbkBkY2NjZC5lZHU=
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x8,0x108,0x7ffb46e39758,0x7ffb46e39768,0x7ffb46e39778
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1812,i,12152935422147338092,8531606997991982253,131072 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,12152935422147338092,8531606997991982253,131072 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1812,i,12152935422147338092,8531606997991982253,131072 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1812,i,12152935422147338092,8531606997991982253,131072 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1812,i,12152935422147338092,8531606997991982253,131072 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3916 --field-trial-handle=1812,i,12152935422147338092,8531606997991982253,131072 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4004 --field-trial-handle=1812,i,12152935422147338092,8531606997991982253,131072 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1812,i,12152935422147338092,8531606997991982253,131072 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1812,i,12152935422147338092,8531606997991982253,131072 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=836 --field-trial-handle=1812,i,12152935422147338092,8531606997991982253,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
690804acb6bb8e9f7a82e282573a6544

SHA1
574b853305312d8c10a8a87e739702d5c6c5e465

SHA256
6c41b98c5c09f8bb013bde28977f4b26ed412aedccc5cd589119d1faae1695a2

SHA512
d3b353c488e13fbc54701d7875763dd4019000ed58dcd7c8d0e0ed869d2f39c96e379081cfb02280ee05026eeb3144b728480e75cf1e74dea632c3a9971002b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
885B

MD5
71cef2a29eba1377b44fb92101523902

SHA1
3bacf49fd95bc0926c1cf0d1f04e79f0af29129a

SHA256
1793a5261454389df3d6b713f85d88c1c096fbb40091ed389261e5c38cf45dda

SHA512
7942957b23bda0f3a59231ff909385dd6c06676a884d713c7f6b50dd106751903aa36390b7044b5a69c9732109cd943620b33f084b25c83f495e0741aa412d0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e498a14281fd6590bf98a1132bd3e000

SHA1
fa418ab4a799f53437a9ee636ee8b270bced1099

SHA256
1907dce68c2bd5aa97d7ddf0a4b2356f77daf1a8bd4cd42d2c7b7e960ec8e970

SHA512
ce7f5cf99b6503dbee27ca086c882fc07ae7d56700cca23f1105a43375b95fc485c7b3ddcba73b8d07bc9c5e867ef54407c089b95aed7fb8819c94940e4d864b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
580c08573efa2122834ab5a47080af0a

SHA1
02d2c16e5ebe7de2aad62e9ce9129427f45ca4f3

SHA256
2f8204c7e3d28c14f163946af84ea78184e54227ef870d3965e52539fdbfe54f

SHA512
1d250f546af01cf39c9e25913445319aedee5a95fd19ee7217e997cb276dd330969d7821f98e832f7eeec2df336b5eab16ec59d9ba77a49382260bb5d3a7675c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8b87f07b718dcadf92ed418e07417640

SHA1
68f1c46ed30ca4a7cdcce2a891e3fc88075407d3

SHA256
ef2d0455bfcc82061a3192018c745509f4103d7e1a7f375bdcabeb02547cf230

SHA512
bfc73c77f12bfd89f6c3065d87e9437752d53c9952fc4c6733fa907e628944da5d2173be2011645b683d3bf98eefa22b94da9efe132220c8652c2c82fd37f064

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
148KB

MD5
1214acc00bd5aec0cfef104e364c356a

SHA1
6dc16e897cd1898aa9a9a6bf461e832b00009533

SHA256
1db05679363532dd048cd7f3033bbc544e4f3bf5b2dac79f738d96fea13c025a

SHA512
a24472e7077144b2bdd0638b41aea3862313cac0437119a0540d54a186462e0670384ae883e919771b694f5a1a7461e678146c76c053c9e37881a5057851f898

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit