hxxps://nymcalumni[.]org/page[.]redir?target=https%3a%2f%2fevents[.]eventzilla[.]net%2fe%2fbriefing-on-recent-changes-to-retirement-plan-rules-2138589532%3fpreview%3d1683815060015&srcid=212827&srctid=1&erid=4492338&trid=19a07c91-b315-465c-9aa1-968418c87a02

Analysis

max time kernel
13s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2023, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://nymcalumni.org/page.redir?target=https%3a%2f%2fevents.eventzilla.net%2fe%2fbriefing-on-recent-changes-to-retirement-plan-rules-2138589532%3fpreview%3d1683815060015&srcid=212827&srctid=1&erid=4492338&trid=19a07c91-b315-465c-9aa1-968418c87a02

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133289113615898836"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 5068	3612	chrome.exe	80
PID 3612 wrote to memory of 5068	3612	chrome.exe	80
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4832	3612	chrome.exe	82
PID 3612 wrote to memory of 4496	3612	chrome.exe	83
PID 3612 wrote to memory of 4496	3612	chrome.exe	83
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84
PID 3612 wrote to memory of 2936	3612	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://nymcalumni.org/page.redir?target=https%3a%2f%2fevents.eventzilla.net%2fe%2fbriefing-on-recent-changes-to-retirement-plan-rules-2138589532%3fpreview%3d1683815060015&srcid=212827&srctid=1&erid=4492338&trid=19a07c91-b315-465c-9aa1-968418c87a02
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe74ae9758,0x7ffe74ae9768,0x7ffe74ae9778
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3308 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4756 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:1
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3420 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4912 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5108 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5728 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 --field-trial-handle=1820,i,2576659006461150048,4514457980447783196,131072 /prefetch:8
  2⤵
  PID:4140

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
162KB

MD5
08f3851748975142ef7c08a8ea1ce61d

SHA1
31ffb52b4d2e4263a2b5a19195ee1784bc884a15

SHA256
e374d418c7975a482356a79e25f0722ab71616be443cb19d96ef88706937bf30

SHA512
d4b86e69582cf1bc33991cd44eb1db26eff3013dcc7ed34d8b7d890be510ef3949a50332e732c22182a8fcbba418c6ba18aa031a6f0b5b621ea2211e665af3f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
09aa7632563eab32a51f60307292bd22

SHA1
7f91dbaa3e856288454885623385eeb8fa6b262e

SHA256
9be267ec2ec566d89de8ca6d8f29a6a2ed529f5d3bb4c850c599e09ff8db4bff

SHA512
efbfd16994d08bdfd2ad26686e6694cc98a346e72249bd4c511a0b34e435b16522da0d3da5cbfefdf370c39a2fb41865a571a3a20b5acc1d9b875af8660d8405

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
23dc6daa98a2d45c480fc8deac18eb4d

SHA1
e5cf3ecf44ad698938c56d3e1f148f2605858b23

SHA256
500b2c4046a510c9e06016e458bb572d4fa7e93e287c5c8590a7585d2bd45f41

SHA512
07f33d6fb9cd25ed172a7c6f527fc7bab6314e4e76504537d998c3b1a83cb9edd1fb24329ca561a389424803b02d4d14db36ee02806d6af6ee579a5bd3367925

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
659b4e864b54cfd7c0a86688790c9643

SHA1
28fddfbc23d4f113251134ddf39698b81688e782

SHA256
544f5af27191dfc714fd5121cb712f8ef8afd75b50b41c4a86371598df06afeb

SHA512
1c8a27918b0f88d769fdedba5d3e5eb5302179a6cf5d114e217bc457c66c543db754e521f466cd79248f2983bdc4162f471504ef89237243d2be9108b0f3054f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
72KB

MD5
ce52d5208afd917fdd964691f6ce62ab

SHA1
ff4136fc94ba877303ea65dde1db6f20f0afd0cc

SHA256
5725b4f2a910b852f58bdfbb7799db04832790b39235466e692cd77e8c39156b

SHA512
3c7950b9525fb6b76f4d181374dae05c21dd34b349a2f38a9581f0e16235f3c0f04e11b010aa2fc34326b4c77c4be965031caf9f07ec8518b24d8b6cd3a48597

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit