hxxps://tracking[.]velosiaims[.]com/tracking/click?d=S9nD73eYaDQHww7qOSj525dpSoO4EpL2tsEvY2r93qjhS4A0nFDKcVI2ki-UOA7L6nM87MHEG1sKLp4EID7aXQVxpRWiMrX0PgUTfBIf2xqpUsPES3E9Hp0WGWctImfOqo2AFLwakQ13Z4hg1k4rjK0Oi9lyXLB9_LNMFyKhh6-fla1Qr7ZymD1Q-wuA67l0m0_BVho_UEUghNY6vh21J2PB6MoH-SD16bVJR28DGUOe4BqBkskLptRGIfdxi2dh_1AFVoAoyk1nR_DNqN8Kwrk1

Analysis

max time kernel
149s
max time network
132s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
06/08/2023, 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tracking.velosiaims.com/tracking/click?d=S9nD73eYaDQHww7qOSj525dpSoO4EpL2tsEvY2r93qjhS4A0nFDKcVI2ki-UOA7L6nM87MHEG1sKLp4EID7aXQVxpRWiMrX0PgUTfBIf2xqpUsPES3E9Hp0WGWctImfOqo2AFLwakQ13Z4hg1k4rjK0Oi9lyXLB9_LNMFyKhh6-fla1Qr7ZymD1Q-wuA67l0m0_BVho_UEUghNY6vh21J2PB6MoH-SD16bVJR28DGUOe4BqBkskLptRGIfdxi2dh_1AFVoAoyk1nR_DNqN8Kwrk1

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133357982530717260"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
764	chrome.exe
764	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 3732	2540	chrome.exe	70
PID 2540 wrote to memory of 3732	2540	chrome.exe	70
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 2372	2540	chrome.exe	72
PID 2540 wrote to memory of 3188	2540	chrome.exe	73
PID 2540 wrote to memory of 3188	2540	chrome.exe	73
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74
PID 2540 wrote to memory of 324	2540	chrome.exe	74

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tracking.velosiaims.com/tracking/click?d=S9nD73eYaDQHww7qOSj525dpSoO4EpL2tsEvY2r93qjhS4A0nFDKcVI2ki-UOA7L6nM87MHEG1sKLp4EID7aXQVxpRWiMrX0PgUTfBIf2xqpUsPES3E9Hp0WGWctImfOqo2AFLwakQ13Z4hg1k4rjK0Oi9lyXLB9_LNMFyKhh6-fla1Qr7ZymD1Q-wuA67l0m0_BVho_UEUghNY6vh21J2PB6MoH-SD16bVJR28DGUOe4BqBkskLptRGIfdxi2dh_1AFVoAoyk1nR_DNqN8Kwrk1
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9c5539758,0x7ff9c5539768,0x7ff9c5539778
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1764,i,17235094360267438275,10872282587688020141,131072 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1764,i,17235094360267438275,10872282587688020141,131072 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2060 --field-trial-handle=1764,i,17235094360267438275,10872282587688020141,131072 /prefetch:8
  2⤵
  PID:324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1764,i,17235094360267438275,10872282587688020141,131072 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1764,i,17235094360267438275,10872282587688020141,131072 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4400 --field-trial-handle=1764,i,17235094360267438275,10872282587688020141,131072 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1764,i,17235094360267438275,10872282587688020141,131072 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1764,i,17235094360267438275,10872282587688020141,131072 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 --field-trial-handle=1764,i,17235094360267438275,10872282587688020141,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
710B

MD5
634c1f50cad13a090120b0b1de984607

SHA1
3fd25f65a94073344098666739aeb1cc7884e89b

SHA256
b2b41b5e6af9fc24e69b400a317a3a29c9762fcedf6251876098f6fd2e757c16

SHA512
7122a89db717294ecb96c84733a27171d989452ee21221492fd30677eb8a3d2375742c2bdb38414060b91d46f90d885b8b713d0ab575fdae50e914348566545f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d5f7d221011af13594dda5d7fb3964e8

SHA1
68232d62cfaae3561b68227d718d53dd339b8474

SHA256
aac6f7c7d3fcfcc8af001b5013442859a7463d8f005e5a8342cf1b86ecfea607

SHA512
72a0fc3571827c2a36ea9ba5907daed75f544efe0ccb6e99369dd9fcb588a475e075ac69588a0549f6d85e317e7b64b5c2cc415c5722179b2724b80895754513

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
81af016da97cc1d252aa861d3677fcff

SHA1
326907b8c7a6960c1065ba07b806f0845f674add

SHA256
d108774242f7b83c9c2b59a5e5b4708acfd485be9e0a24e98ffeb1bb764c25ef

SHA512
62b88c6f69bd456ccce1e3f3a622c05d0391aef2571e521c881f4c0d309bcd2fb64ce39af0694b4fc12e1df57abfc5b95d045dabe925cbc208d0edc51fbad603

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
78e475ef2dd92f5ccd31ab503f3622c2

SHA1
09b6823c7c2cb842bfae87dc3b0f9a8a4d46e39d

SHA256
25ce5dbcc44c37ddcc1b8b76d59c3f108854cbb7f4775c5968fad171c01afdd1

SHA512
a331b354adb2256eb7f519e489834f28d0108f43852f415a982e3749f3ff1d8be7c3857a0eb25a5e4f311158a9b0b34d98bf5bc858a8790001b7d6cfaf5e391e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
fbbc1526cc257c352dbcbc9dde51b80e

SHA1
c465f18dc3c273e44281a9925824dff3d9c743da

SHA256
5ac08308acaa15a25c1042e7d71bbac3f96e4745d5eb2d807c0611277c5329b6

SHA512
acaafb7233ef87dcc40e19aaeb3d2cceb22c2b0d76861c175832735c7cf6251323470f8be0fef6bb927533895c151445420aca3999ce02078135920e2e80bd64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit