Analysis
-
max time kernel
1199s -
max time network
1092s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
24-07-2023 14:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bajrovicgroup-1319541735.cos.na-ashburn.myqcloud.com/bajrovicgroup.html
Resource
win10-20230703-en
General
-
Target
https://bajrovicgroup-1319541735.cos.na-ashburn.myqcloud.com/bajrovicgroup.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133346825230734286" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4404 chrome.exe 4404 chrome.exe 3292 chrome.exe 3292 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 4404 chrome.exe 4404 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe Token: SeShutdownPrivilege 4404 chrome.exe Token: SeCreatePagefilePrivilege 4404 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe 4404 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4404 wrote to memory of 5020 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 5020 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 3228 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4708 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4708 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe PID 4404 wrote to memory of 4856 4404 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bajrovicgroup-1319541735.cos.na-ashburn.myqcloud.com/bajrovicgroup.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffeef999758,0x7ffeef999768,0x7ffeef9997782⤵PID:5020
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1912 --field-trial-handle=1752,i,12257604259844447324,1241676880182072261,131072 /prefetch:82⤵PID:4708
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1560 --field-trial-handle=1752,i,12257604259844447324,1241676880182072261,131072 /prefetch:22⤵PID:3228
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1752,i,12257604259844447324,1241676880182072261,131072 /prefetch:82⤵PID:4856
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2828 --field-trial-handle=1752,i,12257604259844447324,1241676880182072261,131072 /prefetch:12⤵PID:4152
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2820 --field-trial-handle=1752,i,12257604259844447324,1241676880182072261,131072 /prefetch:12⤵PID:1088
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1752,i,12257604259844447324,1241676880182072261,131072 /prefetch:82⤵PID:3444
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1752,i,12257604259844447324,1241676880182072261,131072 /prefetch:82⤵PID:760
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 --field-trial-handle=1752,i,12257604259844447324,1241676880182072261,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3292
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
240B
MD50ce6bff47916a718769a3654662a7599
SHA1b1e87f69cb1637c929520a5a1b0c252a23d7b7a5
SHA256042fa839564ce73f2ac20ba34f15bacef179ced33883366d9fd246d4f75edc12
SHA512f0e3cb7640d71a6635dd27fa5b1bd0f22679ddaf216422fc03c23f37c62f31004b4b1ac6e246a922949e7f46366298134174a4cc51f8ac672becf507521a6eee
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD512b5e83299eda6112f3fc766ba7c240a
SHA1f3c8878961279eb89743fa60210ba44a258e2d89
SHA256ab188b03acd1333be69d138a020619fc85096424e525d25c75566bce6b5d2551
SHA51242ce57cda0b480d3473401f84a9e1262d97ae367de54894e0429ca5308a67128d8b1bb1cf92b8d0d5623623467f51af07cf380b09a958ba7ad28761b163f8bf2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
872B
MD5d8da9e09bdae18983f8c25e52eab9e7f
SHA10afc1fea87921763427b5be3bd0d1427a353c39e
SHA256c5a04b8dbeb2dd895d3c77b3d0cae130ad75c7a00b1b77f3e2b981642fb630a1
SHA512ab6f22234ea0099687bc8558c0cdd55a59aaa7e93bcd8c01bdcd96076d847bf032356acad71185c4da6450be0d6cd44a4ccc14fe1bd55d4c75df8dbd82a5a9b7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5c212807ae05f0de7e2b2da21e3cca5c3
SHA1002ed44128894deba01b9bce2fb0cf85d96e615d
SHA2565e4920b169e96505cd41696a250047ad594c57b20c811503fa41af1450bdfd4a
SHA5128bc6e5474a0dafa11e7d82675e5fa629e989fbd2d488b8d3439d64e564a69f7f2b13698a708f7fe3cef640bf78ec4b08aa5f521805c1ddab18b9af80f01775bc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5f8be088cb55ec68861fcaf8c6fee3b84
SHA1bdf0b8d732152feeae0bf3cf84750fb87b944b93
SHA2566f7ca2e4df73b904f24c63b8fc5d817aa05631fa504841e57fea24fdaf685848
SHA51245134e8fa59bf3a10f31a006616c43396f44b84c1273cd52864e8fc527731177bef04047dc9059afbcbeecf4f96b969a1f23e07d0ecaa90eb7e90d340b283eaf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5f849e239f356c8de74c8df963e6fa032
SHA161c49de5a23f70b2f9ce82df9018681fc7faf6f9
SHA256d7251e7f471c4668781ed98bd4207fd58623fe81cf7f8c021f9e01dc529e6c44
SHA512a3d195f0d37a6dab41f642084fb9e30e201323b178f79d980c7dd898d88ac11db8e2c9f933cea3cb2e14e5f0938cf7c1eda380f427e5853f1e1665220d29d3de
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
87KB
MD5d7b1d14eb87e171662ffdf045d33faae
SHA18b152c6257f4602f52495ba47dc653f89ffdc3ca
SHA256fc1aa88df7b15df4b268e6bbf540db24fef9bca75f58232d2924f7fc0fb6cb8b
SHA512586154c4615dea25de2ac2449404c4c29fbe1f43ec55a6813ab2bf0c65736c7490c2e9ceb60e946be7711faeefad27acc8220e8d4af1e04407d741850db31923
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4404_RZEVMLMBNXGAFWCJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e