hxxps://www[.]maersk[.]com/shipmentoverview/export

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.maersk.com/shipmentoverview/export

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2480	chrome.exe
2480	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe
Token: SeShutdownPrivilege	2480	chrome.exe
Token: SeCreatePagefilePrivilege	2480	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 564	2480	chrome.exe	43
PID 2480 wrote to memory of 564	2480	chrome.exe	43
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 1256	2480	chrome.exe	83
PID 2480 wrote to memory of 4612	2480	chrome.exe	84
PID 2480 wrote to memory of 4612	2480	chrome.exe	84
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85
PID 2480 wrote to memory of 3268	2480	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.maersk.com/shipmentoverview/export
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7aa19758,0x7ffa7aa19768,0x7ffa7aa19778
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1872,i,14853794780549777859,2660802256346225862,131072 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1872,i,14853794780549777859,2660802256346225862,131072 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1872,i,14853794780549777859,2660802256346225862,131072 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1872,i,14853794780549777859,2660802256346225862,131072 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1872,i,14853794780549777859,2660802256346225862,131072 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3828 --field-trial-handle=1872,i,14853794780549777859,2660802256346225862,131072 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 --field-trial-handle=1872,i,14853794780549777859,2660802256346225862,131072 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1872,i,14853794780549777859,2660802256346225862,131072 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3780 --field-trial-handle=1872,i,14853794780549777859,2660802256346225862,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
01e4fd2be576733e727380768d9d7549

SHA1
a9738bd3fbdc5a0fb7e4d34ec5656d52a5531fd2

SHA256
fa19e95b42fc799caccea3553764f315f3d28f95637371c276830d4938708bd0

SHA512
e4752e8b4c0670309c79a89d8dc8787c86d6c5de58295a5bb051ea3464a2ac7f7707fc2e8ddfb75a25a20bdb0c1ab8b14fab74f0f28913bc0e0bde899243c9ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1207a485e45de1598463d955391dab1b

SHA1
77563d3ade3b9e6b6cbc2e54c72485733245f16c

SHA256
e3272679b0c6d9afb732d261f33c9a9e84dc6061f2ff4792282df5197228f6c5

SHA512
9b8ebb14421bbfd3ff3d39e1025fb4072889efdb3972775f490abb68da4487f7a9489fe4cf9ec4387f92ead6d93351bc4e872a9abafaf77e956826590ef82a9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2afc18c62d5e0ae458e36a0ec11a6e0d

SHA1
06faec17a58c321426494d18e4a5b30693ef1d4d

SHA256
97ca97cf60d55801af52e03092192a7e53650dc2787e86fbb1fe03aeea428391

SHA512
4fa0efe4c2cfdc265042faaf8cbb52a19eaf6a4e8a54ca547a70474ddf8ea73b20b5795ae6a2b367df6b00993b781cc319c89a2704d8a4e1ca74ef457b269148

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b692c51cf5b99e8f288f8a218487b895

SHA1
36eba416ff3c034fb54fa5875f34ed5adbf52ca3

SHA256
4249147b12b8f3c1737c7a9db1aabd281085bfa023571d9c1cc7db0e5c276d65

SHA512
b8473a33e90cc61d6be4e5aa46065273848a617ba75c8979b21bc4e83db629671f77001f06671368e9bb167e1e17be61af44592f19fecd65ead1f96ef57ad84f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
803178099c8565fda52beb0141877a1c

SHA1
c3612a395d9ae595db497f02e28be49ada21d9b2

SHA256
fd81bfd899863c66928098cee4dd4d76aa5d1fae005b07d7cd6b957e595211b7

SHA512
6689d761968a09a85eb741e585a2f9353503c968ef032d7a6dd5d3f97ad0e814af555f8ac1d572cd57b126103e8064bef1bf0a5f4ab314f4329522dce06df338

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fc06336c5ceb2fddebe48dbbaa621643

SHA1
2cb2d01e7a6fe95d86a79429f43ffb25fe68efc4

SHA256
0d642c1bf2a0646d2ce4880f8f64fdb9b25db9ba47da2ec3c56e6a648ed535f0

SHA512
53176860569fdaa460599e54c680ee78711daf50bf038a6ec24d8220845c59aac1f150eae66bdc6d2d15fef018114d92e66d63a09a9e546279309ee70ccb6507

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
97KB

MD5
b4c5c4060f8bbfcfb3624934f554bd02

SHA1
e07e245bd8f7cccd37d72df2e8cf413832ad4ee3

SHA256
6040d1599ab1828a08f4cd546bdce3c3541163c138ff3371f601fda35015edfa

SHA512
7c02c765760182c2b34060efd07e812651e95879248bc0d4d21e7cf35b47519d4ff91d55a8af13cdc0f3f3672f078b3eb02b74ce6c0b54bd76f364344e8de0a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit