hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001UhNlcPA2csdEikireojHyi4rsL4Y2-Gwv62Q4cNUQf6D3Xk-fwo5hKbIQvhjeN6Q6ejjMu_YFZ1kc0mQiLUonviEmgkDMOfOh2qKC0CJkOKF_kG3Ko9POhkV7-zHrVbiFSBnaRIaMwy3TJyG0y-p-SHlhxb8tFlc&c=&ch=#aewd@yahoo[.]com

Analysis

max time kernel
56s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2023 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://r20.rs6.net/tn.jsp?f=001UhNlcPA2csdEikireojHyi4rsL4Y2-Gwv62Q4cNUQf6D3Xk-fwo5hKbIQvhjeN6Q6ejjMu_YFZ1kc0mQiLUonviEmgkDMOfOh2qKC0CJkOKF_kG3Ko9POhkV7-zHrVbiFSBnaRIaMwy3TJyG0y-p-SHlhxb8tFlc&c=&ch=#[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133398732563438710"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2128	chrome.exe
2128	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1968	2128	chrome.exe	83
PID 2128 wrote to memory of 1968	2128	chrome.exe	83
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 3644	2128	chrome.exe	85
PID 2128 wrote to memory of 1872	2128	chrome.exe	86
PID 2128 wrote to memory of 1872	2128	chrome.exe	86
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87
PID 2128 wrote to memory of 1596	2128	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r20.rs6.net/tn.jsp?f=001UhNlcPA2csdEikireojHyi4rsL4Y2-Gwv62Q4cNUQf6D3Xk-fwo5hKbIQvhjeN6Q6ejjMu_YFZ1kc0mQiLUonviEmgkDMOfOh2qKC0CJkOKF_kG3Ko9POhkV7-zHrVbiFSBnaRIaMwy3TJyG0y-p-SHlhxb8tFlc&c=&ch=#[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc068c9758,0x7ffc068c9768,0x7ffc068c9778
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1904,i,11234989814951753089,14643215442531874626,131072 /prefetch:2
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1580 --field-trial-handle=1904,i,11234989814951753089,14643215442531874626,131072 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1248 --field-trial-handle=1904,i,11234989814951753089,14643215442531874626,131072 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1904,i,11234989814951753089,14643215442531874626,131072 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1904,i,11234989814951753089,14643215442531874626,131072 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4804 --field-trial-handle=1904,i,11234989814951753089,14643215442531874626,131072 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1904,i,11234989814951753089,14643215442531874626,131072 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 --field-trial-handle=1904,i,11234989814951753089,14643215442531874626,131072 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3336 --field-trial-handle=1904,i,11234989814951753089,14643215442531874626,131072 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3280 --field-trial-handle=1904,i,11234989814951753089,14643215442531874626,131072 /prefetch:8
  2⤵
  PID:3696

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f501b6ed4c329fd5629438a87f2d3899

SHA1
8ec0986aed70047a17e1d16239ad2d55ddb0d5aa

SHA256
9354260d5f4c2df7d7ca4db6278044312afad1b5f75b11d7bcda32519e59d314

SHA512
b075d04919de14223160bf63a1234ebd1cbd50d9a0add07da57053e9880ea05ef9c2c8f86c781fad71e0c3f4121b34f10d56c65c7804633ca43042f84ad8779a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
259d438da875ccdc01e2f06c55323993

SHA1
e1bf9f85c1744ac8427c2bf92f60deca1d5f05a3

SHA256
e27789f5311f276347681f8f6342d7df926a679acfc3795759c879782c8e41b6

SHA512
8c8eba35bf854441e302c2d91b1bacac4c50aef4cb1f2ce273ae2a012197ff7f5c68cb92c840237c8b23fd56fb7534b25f74cbe6f264ad069fc3564038f31134

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
51168cce9089c524590d1c0c0b6c4031

SHA1
02da5e0fcdf912f984c6518af5a88696b3fe6496

SHA256
da4727c1f0638ea4f846a9fe4e4a08c98dfe92bd56f5289757360596cb6dcd23

SHA512
7d0249069273e5a31af0dacd079a5b858d09461710e3cc018eefb49add73cfdb10ba3d1821f8116e0814d98bb1f3d0ea86701478b65132eedc47329394e77a05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f62d26a04a6851288b62aff19e04b1c4

SHA1
75e499d51a20e2f48aaf08af6391b014dcb83b9d

SHA256
00421be6cefd60695401727d8555ccd40c8d97bd11ff4fca82d2deb8f1f5e08c

SHA512
a172d36e8fc826b5d909919842b400afe55a5471101b081614430487fb4b72a2a81a844330e37f23aa24e868d5090646468316a2cb1eb0fbb1d9b7b57f5e1eb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
103KB

MD5
1cb0e5e037fa3d19113ff16e5ece2776

SHA1
5696f23db0e00d85901080163af4b32510fc63f3

SHA256
bdb92063e097f7b5fe7785cde8dafb29d564cc5bc425a6d8dc73efbd6c855af6

SHA512
8fe4ad4b9cac00b6c687cda9e14cd2035ba40cf87e480e906553aa2c60154d26075dde13d53c7ec458ab29297b3d4847baa77836dc60e289eac3c4f6e0b2dc72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a4a4492b-9dca-44a1-9d26-58f075ca457e.tmp

Filesize
104KB

MD5
e92993fe0a99040349744efef2231be5

SHA1
48b68312cd8e3c70998356c11d39c7e6b3f7201e

SHA256
91222131e6101ddb2717c8688876d6af520d320691850d74c891433b9e306f62

SHA512
0762d03a83c18b3278858adf723b14d45a22ff3c0e69dbe2efd64e1da19dba948e263c703a65e514f1c7d2d8ae92e95388d56baa52ebad3e21d9bf5669a67a3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit