hxxp://phreeesia[.]com

Analysis

max time kernel
300s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2023, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://phreeesia.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133293342532203522"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
5000	chrome.exe
5000	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 484	3084	chrome.exe	83
PID 3084 wrote to memory of 484	3084	chrome.exe	83
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 628	3084	chrome.exe	84
PID 3084 wrote to memory of 3660	3084	chrome.exe	85
PID 3084 wrote to memory of 3660	3084	chrome.exe	85
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86
PID 3084 wrote to memory of 2424	3084	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://phreeesia.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec8b79758,0x7ffec8b79768,0x7ffec8b79778
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:2
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4956 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3132 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4780 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2800 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3540 --field-trial-handle=1804,i,7283566110433958697,7324704713208166085,131072 /prefetch:1
  2⤵
  PID:2016

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
e9bd8e131c3cb215a887cf62ad105384

SHA1
78710db47d89a51b667961c4950d49ad8c9e1adc

SHA256
bd9fc8aaa6ccc65b9d93de82609e2ab936efa67588ec24802131137eadf0b233

SHA512
43d01520fdb18037cc3c2413aed76eb86d703197053e55657340ff82481de8a9b90231a69db849c902d008e0ade9f0e132c18bd8e0d10c4f41cecf4d2f309abc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
627ad5f4850e0625ab5cabbbc6cc3121

SHA1
035485bba6ef329438943ff64959267fc462ca1e

SHA256
cd6278c27fcd6621e8da1f24a5085257e05b18487e06db3d978a269ce81786f3

SHA512
e0795491d8709330c6ccd56c18d0928a4d9b86aca41d516faa83cc4aecaa9aa83bcad8732d8af69d1a83615182a32b98676e3da4756630f5f8e98478ad236613

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
44b8094ec27877ec18ed0e9dac7f5dc0

SHA1
c8711212b5ccee7f9ba941ef74b2a7a154dfa7fe

SHA256
ebae0f5402279396168ca220ad95d3edf88339eb5f2f2b4f564911f5fdd5ad9a

SHA512
5bd4da500bb2f41e020c3db812441c528e2a21b689f57da64dbb37094a9d86ba360f8f6cec4107669e42f7538e87f2865f98c12c4a67669a714757d7bf00a2ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
244c29de8659a23373ff0b93c66f9997

SHA1
ae0f1b8ad551fb5810cd4e3e2a159683de2ae66b

SHA256
d0a49a73649805c28b74abbe501c3b0707e4abe7c60507ecec05d5878fb0830c

SHA512
3c97d96c4dba34bb02cb90ed18796f849aea01a89d92a9151176563d630c5d165427233797bd248abc90db10480c1d04ca2d0503548e8057da0cba1c78a2835c

Download Submit