hxxps://links[.]mail[.]service-airfrance[.]com/ctt?m=22412736&r=MTExNDk4NDU5MzI5NwS2&b=0&j=MjA5NjQ4MDM3MAS2&k=usabilla_title&kx=1&kt=12&kd=https%3A%2F%2Fnxlm6x[.]codesandbox[.]io/?register=dnNjaGV1ckBoZWlqbWFucy5ubA==

Analysis

max time kernel
61s
max time network
64s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
06-07-2023 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://links.mail.service-airfrance.com/ctt?m=22412736&r=MTExNDk4NDU5MzI5NwS2&b=0&j=MjA5NjQ4MDM3MAS2&k=usabilla_title&kx=1&kt=12&kd=https%3A%2F%2Fnxlm6x.codesandbox.io/?register=dnNjaGV1ckBoZWlqbWFucy5ubA==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133331203579202510"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
780	chrome.exe
780	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 656	780	chrome.exe	69
PID 780 wrote to memory of 656	780	chrome.exe	69
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 4760	780	chrome.exe	72
PID 780 wrote to memory of 2808	780	chrome.exe	71
PID 780 wrote to memory of 2808	780	chrome.exe	71
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73
PID 780 wrote to memory of 4840	780	chrome.exe	73

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://links.mail.service-airfrance.com/ctt?m=22412736&r=MTExNDk4NDU5MzI5NwS2&b=0&j=MjA5NjQ4MDM3MAS2&k=usabilla_title&kx=1&kt=12&kd=https%3A%2F%2Fnxlm6x.codesandbox.io/?register=dnNjaGV1ckBoZWlqbWFucy5ubA==
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc0de89758,0x7ffc0de89768,0x7ffc0de89778
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1856,i,319000086415062171,13475346958743945395,131072 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1856,i,319000086415062171,13475346958743945395,131072 /prefetch:2
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1856,i,319000086415062171,13475346958743945395,131072 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1856,i,319000086415062171,13475346958743945395,131072 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1856,i,319000086415062171,13475346958743945395,131072 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4344 --field-trial-handle=1856,i,319000086415062171,13475346958743945395,131072 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4740 --field-trial-handle=1856,i,319000086415062171,13475346958743945395,131072 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3040 --field-trial-handle=1856,i,319000086415062171,13475346958743945395,131072 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1856,i,319000086415062171,13475346958743945395,131072 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1856,i,319000086415062171,13475346958743945395,131072 /prefetch:8
  2⤵
  PID:4560

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
dadafd722cc12e22e33db53646782b35

SHA1
556aeb13e668572e792e0e6cd3141076a70647f6

SHA256
0dbd92b7d1be6f9164dd69deb497f7a6833580c038172f80fb15284d6bc575eb

SHA512
00367776f6d289b088b0e1bea6749a78aa679afc2886324cd8b94682b8c69763fd27e08fcb5325236e68984d855a8ccbc7d364baaf1fa796becbba9a73ace1a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
51b8320c0fd6688df75d2566756d9ba7

SHA1
b04028f405478cc16a8dc00d903431c9417f0d01

SHA256
a74109b4854916340573bbdd1ba01c12750558b1b19606b42f0affbba880c298

SHA512
eff2726ec00775af97d6026e775f4b4b2e7ebba042bf049d231ef58fb02b7ba5f24ab1eb1400deb059520d1eb345ed7d6fdfe779f3e1cadf672a3f906773ed99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
42e4e95bd4e09546c98433967533b3e1

SHA1
857145cba93d946d78252b407d90569eb3369492

SHA256
39219d99cf23aed16904b2b78eb1599302f23614d5844ee6378c502a64cefbfc

SHA512
5df98cbd1504b010fb93a5fc18b8422d383ca73b7f5b5330de92782b02567389231ac951f699a43a1ce22eb7eadc2feb93d743866cb386b34fea2b569de705aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5961c55b69ebf4be1c088edef201350a

SHA1
ae96526daf661769a749be1475ea22a38d46e6f1

SHA256
13f969a715225eff8335bfe9eb092d98bcbe52230553ead7e5c25c8f639ab857

SHA512
019bd8cc79de480603048336bc456ea3d5ae7d21b1f8835090b8f73d17e4f0bb579f771e91c66c5212b908fbca11c26a710d77f87273acabfaad582f7d57cac4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
171KB

MD5
342148770d94599f8583a5ea6845e6dd

SHA1
e3f6d7fc624ce97271794b35a4810f449d3400f2

SHA256
0a8d9fd7eca42789e9c920454c05f50beb3cfa8792ba39549606407b2b729b8c

SHA512
e76ce6a613e73fbbc9c99c5e2d079f78ea3e9ea0ce43351b56d58088d786d54e4e5c072d480f2600aee8feb850e923c45274f53db3e45c5b8d134fbe0ceb8cbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit