hxxps://store[.]avast[.]com/store?SiteID=avast&Action=DisplayRedirectCustomPage&Locale=en_US&v=1&t=event&tid=UA-58120669-65&ec=Emailing_Digital%20River&aip=1&cm10=1&ds=Avast&ul=en_US&cs=Digital%20River&cm=email&cd2=Paid&cd4=Business&cd5=BUS-00-000-36-AR&cd7=12632233501&cd6=14203612006&cd8=0&cd9=38044100&cd10=USD&cd11=29&cd12=1635195602479&ea=Click&el=https%3A%2F%2F974140[.]createourbestlife[.]com%2F%236617368677570746140746f682e6361

General

Target

https://store.avast.com/store?SiteID=avast&Action=DisplayRedirectCustomPage&Locale=en_US&v=1&t=event&tid=UA-58120669-65&ec=Emailing_Digital%20River&aip=1&cm10=1&ds=Avast&ul=en_US&cs=Digital%20River&cm=email&cd2=Paid&cd4=Business&cd5=BUS-00-000-36-AR&cd7=12632233501&cd6=14203612006&cd8=0&cd9=38044100&cd10=USD&cd11=29&cd12=1635195602479&ea=Click&el=https%3A%2F%2F974140.createourbestlife.com%2F%236617368677570746140746f682e6361

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133295808743106361"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3364 chrome.exe
3364 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

3364 chrome.exe
3364 chrome.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3364 wrote to memory of 2340	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 2340	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 388	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 2196	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 2196	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe
PID 3364 wrote to memory of 4052	3364	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://store.avast.com/store?SiteID=avast&Action=DisplayRedirectCustomPage&Locale=en_US&v=1&t=event&tid=UA-58120669-65&ec=Emailing_Digital%20River&aip=1&cm10=1&ds=Avast&ul=en_US&cs=Digital%20River&cm=email&cd2=Paid&cd4=Business&cd5=BUS-00-000-36-AR&cd7=12632233501&cd6=14203612006&cd8=0&cd9=38044100&cd10=USD&cd11=29&cd12=1635195602479&ea=Click&el=https%3A%2F%2F974140.createourbestlife.com%2F%236617368677570746140746f682e6361
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd44349758,0x7ffd44349768,0x7ffd44349778
2⤵
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1832,i,8428538103851769130,9584395835551302725,131072 /prefetch:2
2⤵
PID:388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1832,i,8428538103851769130,9584395835551302725,131072 /prefetch:8
2⤵
PID:2196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1832,i,8428538103851769130,9584395835551302725,131072 /prefetch:8
2⤵
PID:4052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3168 --field-trial-handle=1832,i,8428538103851769130,9584395835551302725,131072 /prefetch:1
2⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1832,i,8428538103851769130,9584395835551302725,131072 /prefetch:1
2⤵
PID:4384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1832,i,8428538103851769130,9584395835551302725,131072 /prefetch:8
2⤵
PID:4316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5156 --field-trial-handle=1832,i,8428538103851769130,9584395835551302725,131072 /prefetch:8
2⤵
PID:5068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1832,i,8428538103851769130,9584395835551302725,131072 /prefetch:8
2⤵
PID:4332

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
539B

MD5
1d083d7dbe240cddedb65cf684e82abe

SHA1
2450b624f6491fd71ace39d56760098109e0643a

SHA256
fba00ccd9d8a3dcfd4d785bdba542a784d3f1151ce56a10e6360251fffc5bf7b

SHA512
0ef703b236e2f888975c3cce5c0fd9eebe7ef83cdbdb855882fed32f9140d1a8eabcd0f2e99083a531a9d01e831af6dbf8c08d4ef6b135b49bf1d036cf7589ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2b5adb70e556ca95671af57189bd9f75

SHA1
b5997833029d7721a498ac7a735e1088cc6415ab

SHA256
d62bce8a091ffe7387847ca1bc2771433e5d6de321b4739867ccabb599149be1

SHA512
90fdc90e88c31f8b755d6350dffee7b3e7a48c5b76d0e4e83aad8ca82efbcd57cc63ea93cab704ee7c5258f58c41652e8125747f5afa7a1d49b1999e8b7fb4ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
a624c7076c1a4439a864a14f3001b009

SHA1
7230a59e86b2c88d593bcc381361899b1ddc47aa

SHA256
d2dda28737a382d39ea451dd1944447d7e197a7cb75ba3a224d0322e5c8f1a45

SHA512
7c59c56288e7cf84264504f92054d4452296b35ce393badab733da2e26c2ab6ee60a2a2475f2097c1436e233d537f1772d9fff698b1189a5b95a56194a5136f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
72KB

MD5
8e9ce3f15c82b4e40ca546ed0d8cd8ef

SHA1
ece5afec61ef313ab2a522917725e605e9600f20

SHA256
2b3eba59e863d3c509653b95e5c8f965d13405681900d026d046ae5ad21717dd

SHA512
f916f18eafecb710b8161133bdef0eac73ed73e62a0010d4cea1071a847b5d7f1e212f8bc2b0a19116ffe01d18f547060d85d11d3d9b827f3c53dbeca56354bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
155KB

MD5
8a90483f4dbc6ecaec50319964d78da5

SHA1
499d14e82ed5418dc1f3710f0d35f4ab6201c5c8

SHA256
4094122e227a6e94288a03671b7d919a2bef8a73cce2d05eeedbf020c1cd7183

SHA512
0c734e5c7aa16701234f6826aaef290ccdc1ac1928597e47fb2cca57724e9c2aa902a5da9d94b4e05a1a7c16bafcd8cbfa1d9a53e8992703b8cda39ff7bf4eb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_3364_GYFUBSNLWUJYQZTZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads