hxxps://45xgv[.]top/

Analysis

max time kernel
119s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2023 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://45xgv.top/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1912	chrome.exe
1912	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeCreatePagefilePrivilege	1912	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2788	1912	chrome.exe	80
PID 1912 wrote to memory of 2788	1912	chrome.exe	80
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4272	1912	chrome.exe	82
PID 1912 wrote to memory of 4732	1912	chrome.exe	83
PID 1912 wrote to memory of 4732	1912	chrome.exe	83
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84
PID 1912 wrote to memory of 1452	1912	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://45xgv.top/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe44c9758,0x7fffe44c9768,0x7fffe44c9778
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1860,i,3834211800549139415,6826656723355839303,131072 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1860,i,3834211800549139415,6826656723355839303,131072 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1860,i,3834211800549139415,6826656723355839303,131072 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1860,i,3834211800549139415,6826656723355839303,131072 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1860,i,3834211800549139415,6826656723355839303,131072 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=1860,i,3834211800549139415,6826656723355839303,131072 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5388 --field-trial-handle=1860,i,3834211800549139415,6826656723355839303,131072 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 --field-trial-handle=1860,i,3834211800549139415,6826656723355839303,131072 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5396 --field-trial-handle=1860,i,3834211800549139415,6826656723355839303,131072 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2352 --field-trial-handle=1860,i,3834211800549139415,6826656723355839303,131072 /prefetch:1
  2⤵
  PID:1016

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
e9c854b78f158d916743f6962d2ab1fa

SHA1
220bbd2e1161f85b3ad63a4e24c0d4a5052d8dd2

SHA256
062ec483b027a12e334d0ce188dc8d3b275b91bf258edf84a6dc4bc041bfa85f

SHA512
d0e8ad19a853e5659b94dca98822fca346a1a63ab4f4a51e36fe0930f4b499d3afbc10c9631a6211a7fde4df12afc2adaa358333f7b7c65a7772f61cfc1d52c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
999fb6f17ffe3bf09f40000661d2f805

SHA1
e30d27ffc4092eccab25c7a3f9ac04aefdfc8a55

SHA256
67ba2ff62bc91f46af66e25b1a1ccb3b80da956df4658bcd61ad4996c0a912bb

SHA512
e26eace1ec49a12f970d96cd8d00a4ec786beaf1abd96196c4176f88abce042386c0edd4d89773e9ece59cca57989cb4063fc71ab4ee633834df8281589b3696

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
51d5d0680f4c30649c0d9af0956e73dd

SHA1
a59455e72137c7a0518784db1d423bbd323a9f21

SHA256
43eae113f6f8aee39f91f4aba9a8b4ac84e11458969333ac76aa0a55c8d66d1e

SHA512
45efe5a8686c9dde36f135e175e8a458109a649072dfbdb99913a1726d470e22fe80aa14e46b90e0402376902a7acce0a693156ab3b754d29aae703bd69408cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b086f97c896f736638e59689a746c8f1

SHA1
b223136346207b86215d380938182f150b482092

SHA256
c0e0ebc1c637fb3981d98ac6d7e5e7d5b526214243f404961b5fcf0e17c61a7f

SHA512
788eb81a19c7d6f15f0772f02afe0eed30744107e4702e738191fbf3ebcd102ae28033901404d87f249cf1f4d950b9668b4b36de54b75a49a32a352315f2eb46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ceb93d9d6a695bd889daf951d513569c

SHA1
85d68a1605b8110c7fe25c382a28fd1abd4f72fa

SHA256
f8e47009fe2ca5477348328a8b71ea7be4a54c524222f9738faf0cc3efc5831b

SHA512
5b547ae42c86b79bde435face826bc2785896d962f9771a446e3271aa205da083e1832a30dd497734078fb810baaf9ec21b406e71cdce54082746ed0704acce4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
916e1dac200a27bacb30f25b61172169

SHA1
fc8e3c6e5a99e0d9a8362251adab0d22fadc380d

SHA256
96bc6d590986962bd5eef59e0569357ac4dfa85d0da3f84477632c7ac4e8ca9f

SHA512
7c89a177367f9a3b5b53b78d9bce75942f1a78683107d91d0749a05a0ce88f744fb5d9bf76436585eb54449a070a367ec2043d3aa10b1fb03a098321adefab06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit