hxxps://u511486[.]ct[.]sendgrid[.]net/wf/open?upn=r3XecG9Oeir8G6iSrKDq5D-2BJEgGZh5aARJzUUncIT6ebqU-2FS4gYVcD-2Fmqfp9cURz0AEGNx9BrdAJuDAHZ4PbB7UGtuFs34YeElB0tQfVTyTGExqeymKedV76TGdwOhbFW7PJnwTv8pNgbYA9rzGrGS9ZKEmKEDVgrAOpIRn3uIcwnjkXW0wBhCP8uHkFE1WiwCKTx0nMHn2VUDm0zwEmAjCW3nU6i2EZVuMwYmjox0NV3cgA4ASFnRlGoDfOxQvj

Analysis

max time kernel
1200s
max time network
1164s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u511486.ct.sendgrid.net/wf/open?upn=r3XecG9Oeir8G6iSrKDq5D-2BJEgGZh5aARJzUUncIT6ebqU-2FS4gYVcD-2Fmqfp9cURz0AEGNx9BrdAJuDAHZ4PbB7UGtuFs34YeElB0tQfVTyTGExqeymKedV76TGdwOhbFW7PJnwTv8pNgbYA9rzGrGS9ZKEmKEDVgrAOpIRn3uIcwnjkXW0wBhCP8uHkFE1WiwCKTx0nMHn2VUDm0zwEmAjCW3nU6i2EZVuMwYmjox0NV3cgA4ASFnRlGoDfOxQvj

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133374687055170323"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4028	chrome.exe
4028	chrome.exe
1536	chrome.exe
1536	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4028	chrome.exe
4028	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3196	4028	chrome.exe	82
PID 4028 wrote to memory of 3196	4028	chrome.exe	82
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 4432	4028	chrome.exe	86
PID 4028 wrote to memory of 2588	4028	chrome.exe	85
PID 4028 wrote to memory of 2588	4028	chrome.exe	85
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84
PID 4028 wrote to memory of 3388	4028	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u511486.ct.sendgrid.net/wf/open?upn=r3XecG9Oeir8G6iSrKDq5D-2BJEgGZh5aARJzUUncIT6ebqU-2FS4gYVcD-2Fmqfp9cURz0AEGNx9BrdAJuDAHZ4PbB7UGtuFs34YeElB0tQfVTyTGExqeymKedV76TGdwOhbFW7PJnwTv8pNgbYA9rzGrGS9ZKEmKEDVgrAOpIRn3uIcwnjkXW0wBhCP8uHkFE1WiwCKTx0nMHn2VUDm0zwEmAjCW3nU6i2EZVuMwYmjox0NV3cgA4ASFnRlGoDfOxQvj
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff04a29758,0x7fff04a29768,0x7fff04a29778
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1876,i,9394704189247114840,14944115576457526189,131072 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,9394704189247114840,14944115576457526189,131072 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1876,i,9394704189247114840,14944115576457526189,131072 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1876,i,9394704189247114840,14944115576457526189,131072 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1876,i,9394704189247114840,14944115576457526189,131072 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4448 --field-trial-handle=1876,i,9394704189247114840,14944115576457526189,131072 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1876,i,9394704189247114840,14944115576457526189,131072 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1876,i,9394704189247114840,14944115576457526189,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
824B

MD5
cbc3b4a45b743b069228b6893764f670

SHA1
f62e9274944438898fda8a4c75b833600ad44970

SHA256
2f1540caa4e41a0d1269947096691bfbfc2eba324b7bdbc83fa62c4c6abdb388

SHA512
7db3a3b3f5f2d9f87555d116fcc5b1fca77f59f7674b811b3724fa173799ea3d4ad388fe32049d30e4ff26c88e25fdd2be905691ca870350b02cf28050c29844

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
49e945c87af90e0b54dd5eee4930dc89

SHA1
0d5ed9f2094c4056d805eef24554405729b77b23

SHA256
a3e2c5f3af9073b3cd7da4e3d04705835b30f7b03466960b52e38d49a318275a

SHA512
959e7e545b2ad798efafe7c4c06f3701c615f773f4049b6fcdced38199eb2da4c4b72193d0710721c3f9a92983a5bb4c951e4a884b66e8ad778096526c74c32a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
088b3634c42cc850a75983b733d273e4

SHA1
9f74fda834bdd81d512de4f531594c9443817fb4

SHA256
9bd5b74b57806e6087175bb2b533c459304b7e1a98cce37a8642b74e885e633b

SHA512
615592dc12c2e4805392df632180e439430090fbc313d5890b15ea9f6677517e06a37cedc7599946541fc5c3dc28252425222519723e75afd8682827e7b7b732

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit