hxxps://docs[.]google[.]com/presentation/d/e/2PACX-1vSFHEfy6JaZNsS_cd24y_izrSYzL0YXjx1KSfOlsRyT47WGjU6vFXZYhqyg_rBKpmQAmB21sL6eAEi2/pub?start=false&loop=false&delayms=3000

Analysis

max time kernel
18s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/presentation/d/e/2PACX-1vSFHEfy6JaZNsS_cd24y_izrSYzL0YXjx1KSfOlsRyT47WGjU6vFXZYhqyg_rBKpmQAmB21sL6eAEi2/pub?start=false&loop=false&delayms=3000

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133372511919089596"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4412	chrome.exe
4412	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2916	4412	chrome.exe	84
PID 4412 wrote to memory of 2916	4412	chrome.exe	84
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2300	4412	chrome.exe	86
PID 4412 wrote to memory of 2636	4412	chrome.exe	91
PID 4412 wrote to memory of 2636	4412	chrome.exe	91
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87
PID 4412 wrote to memory of 5076	4412	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/presentation/d/e/2PACX-1vSFHEfy6JaZNsS_cd24y_izrSYzL0YXjx1KSfOlsRyT47WGjU6vFXZYhqyg_rBKpmQAmB21sL6eAEi2/pub?start=false&loop=false&delayms=3000
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5f089758,0x7ffb5f089768,0x7ffb5f089778
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1852,i,3106852107025441149,13632241846023289187,131072 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1852,i,3106852107025441149,13632241846023289187,131072 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2816 --field-trial-handle=1852,i,3106852107025441149,13632241846023289187,131072 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2824 --field-trial-handle=1852,i,3106852107025441149,13632241846023289187,131072 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1852,i,3106852107025441149,13632241846023289187,131072 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1852,i,3106852107025441149,13632241846023289187,131072 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1852,i,3106852107025441149,13632241846023289187,131072 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5008 --field-trial-handle=1852,i,3106852107025441149,13632241846023289187,131072 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5224 --field-trial-handle=1852,i,3106852107025441149,13632241846023289187,131072 /prefetch:1
  2⤵
  PID:1680

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
706B

MD5
445f89174e3dcc9aafb538951e32e74c

SHA1
6054559b48102945a0e9522e9f9534c1225b7988

SHA256
87f8ecfe96e188788e909b7b42946789a6af7707ca96b1fc787933c1c913c831

SHA512
fd65361843266bc72596b123e10c1fc8efb135dbd63218dc1ab82f013cc7993810fbce9573d855a6b7fb05dc294176f1290fe94893d7f7a029868c2844508333

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
618db0deb3232da9c8636fbbe0f64c6b

SHA1
018fdbbc495f71329ddcf244f179ab36ded4489d

SHA256
e76bae43ef69e010c20e020ad1141b71e63dbcab670cfd5e6b8361e9959a1c5e

SHA512
07297400262198c998c978b9b56fc4fe4cd8aa7a6bb6d8fe46926f10d6ef883986e72883ddc7ed1d60e44a56323f56e1228c8b2757f54f879270497709b77aed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
57ae4b5d8a7c310dad62c63906fa1b85

SHA1
c548d1098b963ee2ca69600dfefe32b803c3d4d3

SHA256
e7ffeb1e46d88d5dccdef76b0b2bd604b03b6409ed295003b33cffb29a32bea1

SHA512
98b93a9125e7ae902c826f1bc2691a0bc8781687cc7c5f10ffebcf18614abfb879b3875cc67045f8aae61752ab31b89dfc708ef82d42627da593b9798a728b25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit