hxxps://fastestwhois[.]com/allow/me/jj2i4i/awdw@yahoo[.]com

Analysis

max time kernel
19s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2023, 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://fastestwhois.com/allow/me/jj2i4i/[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133407297437217677"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3296	2760	chrome.exe	59
PID 2760 wrote to memory of 3296	2760	chrome.exe	59
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4572	2760	chrome.exe	84
PID 2760 wrote to memory of 4240	2760	chrome.exe	86
PID 2760 wrote to memory of 4240	2760	chrome.exe	86
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85
PID 2760 wrote to memory of 116	2760	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fastestwhois.com/allow/me/jj2i4i/[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa49c39758,0x7ffa49c39768,0x7ffa49c39778
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1900,i,17994656276465643324,18066523385461435632,131072 /prefetch:2
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1900,i,17994656276465643324,18066523385461435632,131072 /prefetch:8
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1900,i,17994656276465643324,18066523385461435632,131072 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3160 --field-trial-handle=1900,i,17994656276465643324,18066523385461435632,131072 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3168 --field-trial-handle=1900,i,17994656276465643324,18066523385461435632,131072 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1900,i,17994656276465643324,18066523385461435632,131072 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1900,i,17994656276465643324,18066523385461435632,131072 /prefetch:8
  2⤵
  PID:1836

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
535B

MD5
14794ab8e58d2a7985094cf09c29436b

SHA1
3b8d82de58c61661aa6f3927c216da1f0510527a

SHA256
6275dd5c458a71bc7690a56f2c1e82cb4cfe445552a451671b24f9a3ad68f159

SHA512
6078b66150143c590d8667eeca6505014dde9279df2436b5b31e05baf7145df818ee43cc36409c23d4b7b508c8a198d5aa581de0710ffc74569625ba28cb9bfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
c8ab9eecf239c8cad9e3b9545562610b

SHA1
6a6439b942fbf7fcca5dee21c2fc5934dd2284d8

SHA256
4f8864d6f84441967d375c6346644d1d3d795a081ea95607e79fec97bd6fe5de

SHA512
2c4fa41ad42658faf04c549457409ac7fdc1de7ed8285960b5de7a82060d437c0d7475ca0e5b141ca1db359b9bf5e01760d2668607f3c8c8be3a7955167111ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
104KB

MD5
14c00c866b3cd6dccc0ea175ad67a534

SHA1
838c911a29bce861861ed798b803ec9fe96711dd

SHA256
f6eae045b8918e8e8a52909e916dec3916f8f889f81081f18cbf3fd50552f3af

SHA512
1f97550d6411468089ed56523b0ca9e1642d800e5456bd6ca8ba261f4750341aaa63064bd58d2152b2922e1479b8cd5324627ac990ad6e0644437d3f967cb517

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
103KB

MD5
7d0ca0f55961e3a42a810ac694ea72f9

SHA1
dc5f27f7e2ffbae96c6b11b97b3f12e9c3bce906

SHA256
7a0dea550a1fccda0163d598c5fcda472650c2906491c5edd1cd1767e3772748

SHA512
c03e9a3a1ef6c9e89d08a52b5a79b25721541f22ffe3e76521cc6aa16792cec5dc2edf8b2909f3148a6e70bc3876b8851c3db1edfba4554626b84a2330da6d8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit