hxxp://58[.]22[.]2[.]105[:]18080

General

Target

http://58.22.2.105:18080

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133295832983679798"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

5012 chrome.exe
5012 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

5012 chrome.exe
5012 chrome.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 5012 wrote to memory of 3960	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3960	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3760	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 2028	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 2028	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe
PID 5012 wrote to memory of 3740	5012	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://58.22.2.105:18080
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xb4,0x100,0x104,0xdc,0x108,0x7ff8669d9758,0x7ff8669d9768,0x7ff8669d9778
2⤵
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1876,i,16855379372458097719,10482520939899514456,131072 /prefetch:2
2⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,16855379372458097719,10482520939899514456,131072 /prefetch:8
2⤵
PID:2028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1876,i,16855379372458097719,10482520939899514456,131072 /prefetch:8
2⤵
PID:3740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1876,i,16855379372458097719,10482520939899514456,131072 /prefetch:1
2⤵
PID:4824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3144 --field-trial-handle=1876,i,16855379372458097719,10482520939899514456,131072 /prefetch:1
2⤵
PID:3792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=1876,i,16855379372458097719,10482520939899514456,131072 /prefetch:8
2⤵
PID:4076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1876,i,16855379372458097719,10482520939899514456,131072 /prefetch:8
2⤵
PID:5048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1876,i,16855379372458097719,10482520939899514456,131072 /prefetch:8
2⤵
PID:3196

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
0b177a5a91676e48cd83071ab9f0d97d

SHA1
fdb2b0a6033afb74f05013e34aaf8ca4fbc0df95

SHA256
6b7848059f90a1c4303932c0f2427160f18a166a2551c34f9a8b31d6b1c0d834

SHA512
ca74c999a4879cdd78205196453081d84122f5e68bc226405027e5695581460ba994beab7663073e068aab5a1159745c8e585c7f9547bf4fd0b4ca3d5fc3a4c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
9663f5ec8435bd9ab14830be584e8a03

SHA1
17cdbbcdc6b51e6cb02d46e926820a347f9666e3

SHA256
ca8b93bb01e320edbe60d6bc20499663ad5390625dbdc7de46969edbbb3d87a2

SHA512
6b7ab83dc2e04d99e31287af76222c8bfdf145d7b52590ef30b729aa7ebc59e3ecaaedb28352c360c91544f4b2204a440e5be696c6edd2d595e55dbe35574aef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
a0294921f8f3047aad6902c514f0452a

SHA1
b55f70352dec3f47663bc4870a539e5a84ccee5e

SHA256
80a3ddec92fd508cc1a0c33a8477123a15454ecf62f49f18ea87964af2c7ad8a

SHA512
09747f81fe43d6fd03d34e1299ad2736531c6b86ed3edd3dfac41a4d986335d809e2234ac2d6b046fb647d09d8dcb2461256891f8e70e2aef9b4338a622e97ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
153KB

MD5
00a915bdb086171478eb0850171fb9ef

SHA1
3abdc4385f5f14c88750649d3db91079f12c56d3

SHA256
154136af953637aa1c30782d3cf4d5dd0da61fd521a85db9c410d38f9b5d4f03

SHA512
99f968aeca21b48b0f26175ea6e393beb6a0eb658124f38379a2e34b486efd30a140fa03c0e14a54ddc1c2d421f4404a40334351aa45e19ceba7fb0b61ec2982

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_5012_NQGRYFSKDHJOCVIS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads