hxxp://a815a0b269b119624[.]awsglobalaccelerator[.]com

Analysis

max time kernel
1800s
max time network
1690s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2023 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://a815a0b269b119624.awsglobalaccelerator.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133337925301628621"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1348	chrome.exe
1348	chrome.exe
1476	chrome.exe
1476	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 4924	1348	chrome.exe	84
PID 1348 wrote to memory of 4924	1348	chrome.exe	84
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 456	1348	chrome.exe	86
PID 1348 wrote to memory of 1384	1348	chrome.exe	87
PID 1348 wrote to memory of 1384	1348	chrome.exe	87
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88
PID 1348 wrote to memory of 1060	1348	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://a815a0b269b119624.awsglobalaccelerator.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8d7a9758,0x7ffd8d7a9768,0x7ffd8d7a9778
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1828,i,5091207404556265886,15020468753765944852,131072 /prefetch:2
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1828,i,5091207404556265886,15020468753765944852,131072 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1828,i,5091207404556265886,15020468753765944852,131072 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=1828,i,5091207404556265886,15020468753765944852,131072 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2848 --field-trial-handle=1828,i,5091207404556265886,15020468753765944852,131072 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4860 --field-trial-handle=1828,i,5091207404556265886,15020468753765944852,131072 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1828,i,5091207404556265886,15020468753765944852,131072 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1828,i,5091207404556265886,15020468753765944852,131072 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 --field-trial-handle=1828,i,5091207404556265886,15020468753765944852,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6f349b7d-7a13-4d5e-8e90-97c887dbfa75.tmp

Filesize
6KB

MD5
a97122ea50d37216d0e4bb8733cb692e

SHA1
b9abb606554e2b706d095313f3fdfdfeccfe087c

SHA256
c0ae1c85f47958e8df4725dda0a5f1ef6bbe46df1b208a1971f71db868cef0b5

SHA512
a04b10c8cf1074c6611cc56575ff178afa20054ffd6b58e692157cc1c380135417651c4e8cbfd12cf5a7f6e7be9263fe497c8f43d648a22dc2f32b21a26cf4ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
33f3c67aa5c3bd6f21162df183109cce

SHA1
b7a4a72a0e0a996bfb3cdfef7d199c73afe93dda

SHA256
59399adfdcf469705b20ddbb34e0acaf8b5f7892b7148a30acdc8fd62cc8b50b

SHA512
d28c37f5cc64323022a230501b52473951191276bffa70af3a03d312b61116ed9d45d47740b9e5781b6f52c4ffbfe7d194842967b512c3f1e3777661f344f2c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d270ec36c1dd85f3347c0da7add6b652

SHA1
a268ab8e4c651bb98c19a41013f482597f2fef31

SHA256
1aff4bbd69833cc2caa0f7bebb0d2505e5fe579f2b16db5bce6e0cb174dbc74d

SHA512
4ea535ceaea0f57e0f53a74d8bd3e0ff4220c10e9a4e7da8daca5d5e280a5d511abcd854e0ed81fa210c4d270bb5071502f7764dcf64cec650e21186f3540331

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
6efcc987bf60e20939f3897a79c6ae6d

SHA1
0dda45c07c5e6bbaf9079d2c71af440b04fd6c13

SHA256
23c99f5758f601bd59ca71b5d532e55a3da43b5031466278d6d09fa19bc97f0f

SHA512
4c9ebfb2e8c5e871e1a174e2b11682fc7536a2ddbd13dc65eeec006357bf8670eea9ef75362bccb0abf7995d511a1691f42c367ef0215c59595b538e1e74ddc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit