hxxps://go2[.]hakonebox[.]com/f/a/vIDBE7nqTf6GzxjHpd9qHnw~~/CswEyLL~/aHR0cHM6Ly9saXR0bGVtYWd1c2EuY29tL2RncmVnb3J5ZGVjbGVyY2t0WA==

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2023, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go2.hakonebox.com/f/a/vIDBE7nqTf6GzxjHpd9qHnw~~/CswEyLL~/aHR0cHM6Ly9saXR0bGVtYWd1c2EuY29tL2RncmVnb3J5ZGVjbGVyY2t0WA==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133294211047284344"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
4320	chrome.exe
4320	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 2436	5024	chrome.exe	86
PID 5024 wrote to memory of 2436	5024	chrome.exe	86
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 2060	5024	chrome.exe	87
PID 5024 wrote to memory of 368	5024	chrome.exe	88
PID 5024 wrote to memory of 368	5024	chrome.exe	88
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89
PID 5024 wrote to memory of 2820	5024	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://go2.hakonebox.com/f/a/vIDBE7nqTf6GzxjHpd9qHnw~~/CswEyLL~/aHR0cHM6Ly9saXR0bGVtYWd1c2EuY29tL2RncmVnb3J5ZGVjbGVyY2t0WA==
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffdcdcc9758,0x7ffdcdcc9768,0x7ffdcdcc9778
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1896,i,11337780500223391062,8057700986510856551,131072 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1896,i,11337780500223391062,8057700986510856551,131072 /prefetch:8
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1896,i,11337780500223391062,8057700986510856551,131072 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1896,i,11337780500223391062,8057700986510856551,131072 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1896,i,11337780500223391062,8057700986510856551,131072 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4560 --field-trial-handle=1896,i,11337780500223391062,8057700986510856551,131072 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3400 --field-trial-handle=1896,i,11337780500223391062,8057700986510856551,131072 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1896,i,11337780500223391062,8057700986510856551,131072 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3224 --field-trial-handle=1896,i,11337780500223391062,8057700986510856551,131072 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2776 --field-trial-handle=1896,i,11337780500223391062,8057700986510856551,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
957B

MD5
f0e5726769805d94b7ab23ddaa6ba07a

SHA1
5eab352e229f53c10fe1e90b056b506724b86b35

SHA256
d929deebd619ab580b0e2c5106e082b2b64d272995df10dfaa4fb8669eacec00

SHA512
5371b2315a1c82ed9a3a57e580f0fe4b591764b6680b16f397436decc98ef007e0c81d0f2eb1eabc6712f0fd55e9905651d4f3733a48b006a47f4b4f1d2a692c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2cdf639a772217b50aa8d4a45d447e7d

SHA1
9608acdb08f8bc434602b01a233ab3a249c1e1dc

SHA256
94ae2c355b9dafe4983a3f944797f9a2d600bc86aa2559f27e62a03d02f17691

SHA512
5c8981e43b5efa6af3e569279c58867f9aaaec1bb425beb97cd927c93b8f9a0447f875569013af9e36f2bca82157f4d5a84aa86dd703bad48d60896223c62c57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
623726404aed0ebe560e91c72ad86769

SHA1
5146c7b2929096ee015007d17077fa56c64b55bc

SHA256
2f9e12e96c6036a5eb015614bfe5636184371242f2d083333bb08dc2b2b2361e

SHA512
8da201ddbc12e99b60b4beb1d73bf3fb0de99342da0abfeccfd89077fee113e567df34b0d77057a9d094b668781df2c76cc3b5a1cdd363702814a181f0a0b04b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
bf46d47a0507be2e9ab8f71c74068ce2

SHA1
0e05da8ba5d6db3077753662e98e7439ffbe87f4

SHA256
7bac63f30c8f19e2a83c5678b350b7a009674795c8daf12e956b82dd84258b5b

SHA512
0afecde0f39e80bf1694eb6bd11b6ce65086416b4d426aa3d5b314e964594cbf7cb98f00512323e2445a08888ab2df944f075f9489538d14ae68fb9b0abd036d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit