hxxp://links[.]newyorkhonorlodge[.]com/e/encryptedUnsubscribe?_r=974025a2a2394b138c6b27df68c3a443&_s=3cf244f4030d4ec083f5a055d8f7cf29&_t=fvgaMgsKvDZzfeGtEb2-e1q7BBGkyHN708EXMQWQhAvNOkh6ZutXHwtt_DDeyfEch2H86aHvs9xOxN0Cc5fC26pnv1DXcVyS7nEJVPaNTaIJaau8xGRIp6_6g3qTzpNbRfAMIP6hLJZ0tAtsgUuTsw%3D%3D

Analysis

max time kernel
300s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2023 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://links.newyorkhonorlodge.com/e/encryptedUnsubscribe?_r=974025a2a2394b138c6b27df68c3a443&_s=3cf244f4030d4ec083f5a055d8f7cf29&_t=fvgaMgsKvDZzfeGtEb2-e1q7BBGkyHN708EXMQWQhAvNOkh6ZutXHwtt_DDeyfEch2H86aHvs9xOxN0Cc5fC26pnv1DXcVyS7nEJVPaNTaIJaau8xGRIp6_6g3qTzpNbRfAMIP6hLJZ0tAtsgUuTsw%3D%3D

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133355974377665783"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4960	1528	chrome.exe	61
PID 1528 wrote to memory of 4960	1528	chrome.exe	61
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 4976	1528	chrome.exe	82
PID 1528 wrote to memory of 3116	1528	chrome.exe	83
PID 1528 wrote to memory of 3116	1528	chrome.exe	83
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84
PID 1528 wrote to memory of 4452	1528	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://links.newyorkhonorlodge.com/e/encryptedUnsubscribe?_r=974025a2a2394b138c6b27df68c3a443&_s=3cf244f4030d4ec083f5a055d8f7cf29&_t=fvgaMgsKvDZzfeGtEb2-e1q7BBGkyHN708EXMQWQhAvNOkh6ZutXHwtt_DDeyfEch2H86aHvs9xOxN0Cc5fC26pnv1DXcVyS7nEJVPaNTaIJaau8xGRIp6_6g3qTzpNbRfAMIP6hLJZ0tAtsgUuTsw%3D%3D
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7fff03de9758,0x7fff03de9768,0x7fff03de9778
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1912,i,10730873251734641669,13931374250507138107,131072 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1904 --field-trial-handle=1912,i,10730873251734641669,13931374250507138107,131072 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1912,i,10730873251734641669,13931374250507138107,131072 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1912,i,10730873251734641669,13931374250507138107,131072 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1912,i,10730873251734641669,13931374250507138107,131072 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1912,i,10730873251734641669,13931374250507138107,131072 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1912,i,10730873251734641669,13931374250507138107,131072 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3880 --field-trial-handle=1912,i,10730873251734641669,13931374250507138107,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
772B

MD5
220f7a693182588170f4f58292dc1030

SHA1
fa924e09095812f9c1f1edda3d38942a4501ef09

SHA256
83d93975a1648800060ce5ef2cd103cffaa579af0eacecb4b49316e65a60441d

SHA512
8cc29d973dc12851fcf873a0fe431024759cafb64ea85f85102cb96f909aebb1be31cf07fb8ecb7c49ea42e9ac2deb6d75b276a1e7ae221531eb48ebef8d215e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
fd5e61f0578467e2585a08be7968cf5d

SHA1
c40bcd212b2ea52d71776d4be6c3af8a753e4133

SHA256
5d9c6ec186be199dcf2d395ef5410e8dc8ad183f4328f3b754f5ce1b7c2c2a5b

SHA512
696ebfc243766697c5b39ca07eafd0a9b68a69e9d3d264933cdd3bbddad4defb6ca4c9e8e197e52e4b57e8c0dbfcb808ba5ec7824cdb4fd94c9d80cf2a1ac1e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
99229206f3e4331f486a507d15b37cd7

SHA1
cfe76a3bf5f08da904a12346fe79d8843b724054

SHA256
c6cedabdaee1d0f806e34144962e16ed07eaf89e09897073da888ae203ab7f55

SHA512
e1c707cba621aa7689a627ea6c220d9499d3ad4adbff9402a4df89fd510d72dc92923ba3fad1836956df49543ef64cd243bdc08cd648fb8d55774334b3fc2eaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
933b4d79dfdeb017dca42785f18715e4

SHA1
9e28c3925c179bb8189b9aff2ccb30c6adcf60a1

SHA256
2683eda3dca37ed0221232f5cc74f69718bcc3ed60175809d83d8422733dd9d0

SHA512
f8659bc1df18d2fd5d5e4474c1d938cde4b7f982c8f5a7f9c5c66ced26beaabbc945cc4d840dcfafd08da188e7da0ccebac7988783f6ecebeb2a517ef5404977

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4222f35fc4431440548032de0ab6e58a

SHA1
ef002397bc9d3884be2ffcf982d0b8cfb0a2a96d

SHA256
a85a0ca7ff7ad700a28273a3a0dc8d74c78130de8475c32591ee16788f301062

SHA512
69710a1131faa12bbeb77797f42d70384fb4727a64a25792c7b6a5f1285d6e3cf8c87fbdee71271a8eb159c75cf03174782f73c3f7617f2e3cc67816ac7d4e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9d8705f3a9757827270eeba8f55eacb5

SHA1
3caf043a39324951460030a619dddd13cc935a26

SHA256
bb2a13843bbeeb02bd0dbb3e6f54b38638bd319b1426efc4cffeb43f2c71a58c

SHA512
f40257d2e5194e22bd5e6fbf9ebf0cb68c642b5a93cc612d33d3eb79ce7663bb4534af4fd02ce693faf7b5fd408bb9654e67b8e780eb3fb07f71a5197f654d7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
2461b471f142a4b87b13b005c6dd780a

SHA1
3370909587fd4478d4c6245365d3ab15e742bd78

SHA256
ca35e3530f4d2e032114a202956a2dafe8af1bf02b1e916064b8556cdf90e375

SHA512
6eee8f698748004540ec7cc43155c09916c17438325b273f80a7d6912af0f346078e7520426d5ea7f96927c494c9ebe5289b613c6c4b2f399bbdd0a3e1bd1d24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit