hxxps://docs[.]google[.]com/forms/d/e/1FAIpQLSenLjp2unrlG7Im2GYdGA3HmOhE1kHu-FkhKEsQtByI0lD0Yg/viewform?usp=pp_url

Analysis

max time kernel
18s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/08/2023, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/forms/d/e/1FAIpQLSenLjp2unrlG7Im2GYdGA3HmOhE1kHu-FkhKEsQtByI0lD0Yg/viewform?usp=pp_url

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133377277180390732"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2920	chrome.exe
2920	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2920	chrome.exe
2920	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4388	2920	chrome.exe	82
PID 2920 wrote to memory of 4388	2920	chrome.exe	82
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4864	2920	chrome.exe	84
PID 2920 wrote to memory of 4204	2920	chrome.exe	85
PID 2920 wrote to memory of 4204	2920	chrome.exe	85
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86
PID 2920 wrote to memory of 4796	2920	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/forms/d/e/1FAIpQLSenLjp2unrlG7Im2GYdGA3HmOhE1kHu-FkhKEsQtByI0lD0Yg/viewform?usp=pp_url
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee2cf9758,0x7ffee2cf9768,0x7ffee2cf9778
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1836,i,5681703937687296119,10068324370205384619,131072 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1836,i,5681703937687296119,10068324370205384619,131072 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1836,i,5681703937687296119,10068324370205384619,131072 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2864 --field-trial-handle=1836,i,5681703937687296119,10068324370205384619,131072 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2856 --field-trial-handle=1836,i,5681703937687296119,10068324370205384619,131072 /prefetch:1
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1836,i,5681703937687296119,10068324370205384619,131072 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1836,i,5681703937687296119,10068324370205384619,131072 /prefetch:8
  2⤵
  PID:1380

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
4c0d0f73bc0461cbb34fc3ca1fd12d88

SHA1
2eedd337c7bdd31ed22308ddd204ad26080bc6af

SHA256
2629228bb6ac57f194bf617cca094d0c0101ee8abd944cb33e7796c5fca16bcc

SHA512
6987771efcf0c306346d830303cab0c2b5dbd0a444661999697295800bcec10411868579efcbbdbc237ada1431777b096990d128a91db4c52c0e2e143936e607

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
48f5f014ec968940eff9f83ac1f84f8b

SHA1
888c56d30b8b3a506cc7d1946dff7907b16b41e5

SHA256
f6b5b8f3e3166694a97aefc0040853c99544c776c69473d5def48ad8e03701ba

SHA512
82ca773de28277a3360d02e46a83f1b4eba5b1e8103a6c68d1dafaba65eae478d50722e60ee11f51c8ebf6fc31688794ca3ba51b9b4c09abd2d92c908b1f97d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
e5a2c96b550ab29a21ae94c4314c0766

SHA1
612c206ca20084458eb482f1c8ce45e090ce199a

SHA256
678bad18bcc786ab8e26b551434233f534f638eae3a1736eb1322c6b15412aed

SHA512
382b600d450ffefad8b8aa8822b837e057dfe1c3303d0c00e7a6bd09c82a82952c5517830440d8b8ee3cf702f15afa449a3f6a59e84011a093965de5e3d83c43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit