hxxp://beegrenugoz[.]com

Analysis

max time kernel
34s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2023, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://beegrenugoz.com

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133357607141278005"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 2744	3292	chrome.exe	68
PID 3292 wrote to memory of 2744	3292	chrome.exe	68
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 3124	3292	chrome.exe	85
PID 3292 wrote to memory of 1392	3292	chrome.exe	84
PID 3292 wrote to memory of 1392	3292	chrome.exe	84
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83
PID 3292 wrote to memory of 1284	3292	chrome.exe	83

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://beegrenugoz.com
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98b089758,0x7ff98b089768,0x7ff98b089778
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1900,i,10454699408511428154,66359374047891577,131072 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1900,i,10454699408511428154,66359374047891577,131072 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1900,i,10454699408511428154,66359374047891577,131072 /prefetch:2
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2940 --field-trial-handle=1900,i,10454699408511428154,66359374047891577,131072 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1900,i,10454699408511428154,66359374047891577,131072 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1900,i,10454699408511428154,66359374047891577,131072 /prefetch:8
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1900,i,10454699408511428154,66359374047891577,131072 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1900,i,10454699408511428154,66359374047891577,131072 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1900,i,10454699408511428154,66359374047891577,131072 /prefetch:8
  2⤵
  PID:4500

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c43ec1f15732786b242447ca29b8f843

SHA1
51b9e0e81d1f6324a3f702509afea2456a73c5bd

SHA256
8c602a921a09b9d4a83d0729e4251eabee92351618f6e6fdd3680357c4d9e9ab

SHA512
e1bd66f1f2609e34fe73133de43e23a2f0c54c78e286aa6b81a2af5866b204d474b5fab6003b51ef0c32121ff98b3e9b195a6d8e1a9de954d37942d896651b32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
92fbb351e88674d2519c3148ba6c22e6

SHA1
11c844a0ee19d4d43a9800a72589c1e3aef68dc6

SHA256
844bdc51d5df5c00f00c71a3ffa16bd3deabd8b1bd4d4e7ba39bacebc20c35eb

SHA512
fc7d840909c6b6a7e98c6a0742ce3640b61af454e9b6b5f1f8d3cede6794c73dfeaacc95852b2b18708271316823c0aa0b66433b8a103f29677b07e376231ce7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
e263cb6d69afd453e3849810226ba14a

SHA1
c18f1427f5c3bb974c57c9526553ba88d4c10a29

SHA256
f670002c53c980af60a006152b6dc70cd27a283f40fb4187aaf35f161f9082fc

SHA512
97d37f3cfd371c4d2443a66fb8d0449ef08d95a9ee4774f70c7fae2dfa223bcf08a22d01eea26e603f424d5aa054505a6eb1c8c2c36a7f6ef119f052b23345f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit