hxxps://chinarfdc[.]org/fromf/freedom/lqljyw/dawda@yahoo[.]com

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2023, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://chinarfdc.org/fromf/freedom/lqljyw/[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133409142372845199"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
3392	chrome.exe
3392	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 32	4564	chrome.exe	61
PID 4564 wrote to memory of 32	4564	chrome.exe	61
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 2648	4564	chrome.exe	87
PID 4564 wrote to memory of 3000	4564	chrome.exe	88
PID 4564 wrote to memory of 3000	4564	chrome.exe	88
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89
PID 4564 wrote to memory of 1180	4564	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://chinarfdc.org/fromf/freedom/lqljyw/[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd18e59758,0x7ffd18e59768,0x7ffd18e59778
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1888,i,13011057228325080322,11172194856908947797,131072 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1888,i,13011057228325080322,11172194856908947797,131072 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1888,i,13011057228325080322,11172194856908947797,131072 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1888,i,13011057228325080322,11172194856908947797,131072 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1888,i,13011057228325080322,11172194856908947797,131072 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1888,i,13011057228325080322,11172194856908947797,131072 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1888,i,13011057228325080322,11172194856908947797,131072 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3948 --field-trial-handle=1888,i,13011057228325080322,11172194856908947797,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3012

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
0183463ffc16c96e71bd84148911560e

SHA1
29b60a3f6a27f327d9c2e980a45cf3729ffe7914

SHA256
f84734104110078acb96f463f27329abbb57e3abd125e1c9e1fd50d8847a07e5

SHA512
5b782a44726bccfc6876b91e4148615b97c8caee8285d18da1a5f3c5c102cf104959af4f49350102b02a72df488c323c7fe1234da3f173a94053dde9325c41a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
78b6ddbfec86babac221c70602f0812d

SHA1
526ed90d187cf9d1c759697f137a102ad682684a

SHA256
176bbd71cfb45cfc6ab931fe45b49566b1f60151bfee29019e8e545c629360a8

SHA512
fa00c939e3afe34862787ad314b5dfd9c7e37a53e146ba59f3f019442196ae36d719e92af4effdac8244bdfe13108e11cbc5620a9b4f6d1d4fc1017db5f9bb55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
8d0e8639aa898d31a0bc332b8d74c430

SHA1
821a8f53ebb0321c4dcef0f5602e15174127090f

SHA256
9a2570763851a80588831777231b662502075f04c4982f65f895e61067408c1f

SHA512
5950a2805ac7805239987a0ffaec2a1b10f50d772dfe475266efaf0035697c569fa17f158ea388f5cb6c94c377c1d7c239a33d23702f4328e31a373e2ddabc24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
003d7ad1eb0e38847f619916842d79cd

SHA1
8ccef1e09065d737ce576981f984c570d1332a5c

SHA256
9627ea50de5b170e295a785e4eea7db6704b79f3042498e6f24e95bc4d8b59d2

SHA512
9dadbec3022cfa8621172d4ccaefcde33e2280c1ed6dd61bf7ddff3f659f19db664aecef44e3550148564a3c7ef45d4fb16f8e1655a020ce163920333df23f15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
706B

MD5
577d160d1b4ecfcd68f4251501840406

SHA1
461e91d55014852b102683e01fce864b42ca1f0f

SHA256
c39089b748ebed9cd1f0cace43404d25125ba5fd4828233cf62b0cd533a956b5

SHA512
b29c304af4e3451f7a6436a32bd2e34318761f82ee27a008652412c946ea942946f58191a67a36095feecab9caddbe45b9996241a48106078eec660c0029d242

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
15fadedd2028b46ed6db32c5b82a86e2

SHA1
f26b29ebd6b8ecb46a8e9eefb15946b36da8fb81

SHA256
f20d09fd29e72a3058e573b0644b943ffb4046291771a8ba64a573575312b1a4

SHA512
8de6f799a815f757fa383933576f119da872c9cfa4b0227c634b10db48b1c16d5ac608687d16f7521ff7b113e8620f4453a543a9544aa460860bce1a67923be4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
37da608d743c956f7d0129a989936d39

SHA1
687ee7e5c0e49dfa917f7e42c890d978deb3adf6

SHA256
120b23ae10f018aced9f593f9e86aac83b1b9b795893f0ce01ce94475360d0d6

SHA512
ba83f5dbed450b432580398f21a434d800411f2e82d52201cb3b726d09b27c3650c89d3dce0571820d3cba653b402f7623436fc4713ad372574f31d3fb0b7e4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
memory/3076-142-0x000001D7D4EB0000-0x000001D7D4EC0000-memory.dmp

Filesize
64KB

Download
memory/3076-158-0x000001D7D4FB0000-0x000001D7D4FC0000-memory.dmp

Filesize
64KB

Download
memory/3076-174-0x000001D7DD320000-0x000001D7DD321000-memory.dmp

Filesize
4KB

Download
memory/3076-176-0x000001D7DD350000-0x000001D7DD351000-memory.dmp

Filesize
4KB

Download
memory/3076-177-0x000001D7DD350000-0x000001D7DD351000-memory.dmp

Filesize
4KB

Download
memory/3076-178-0x000001D7DD460000-0x000001D7DD461000-memory.dmp

Filesize
4KB

Download