hxxps://myimpact[.]in/index[.]php?page=Nclipj&id=66a57846cc1f28fe77c2e7fce3312d88&id2=738a6645518d3ad63caef923eb9d80a2&id3=c967f0af35940c241c8667604654522c

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://myimpact.in/index.php?page=Nclipj&id=66a57846cc1f28fe77c2e7fce3312d88&id2=738a6645518d3ad63caef923eb9d80a2&id3=c967f0af35940c241c8667604654522c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133411708576326480"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4692	chrome.exe
4692	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3284	4908	chrome.exe	39
PID 4908 wrote to memory of 3284	4908	chrome.exe	39
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 624	4908	chrome.exe	87
PID 4908 wrote to memory of 1028	4908	chrome.exe	91
PID 4908 wrote to memory of 1028	4908	chrome.exe	91
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88
PID 4908 wrote to memory of 4344	4908	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://myimpact.in/index.php?page=Nclipj&id=66a57846cc1f28fe77c2e7fce3312d88&id2=738a6645518d3ad63caef923eb9d80a2&id3=c967f0af35940c241c8667604654522c
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6b419758,0x7ffa6b419768,0x7ffa6b419778
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1888,i,757730231529023967,11781036656128606512,131072 /prefetch:2
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1888,i,757730231529023967,11781036656128606512,131072 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1888,i,757730231529023967,11781036656128606512,131072 /prefetch:1
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1888,i,757730231529023967,11781036656128606512,131072 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1888,i,757730231529023967,11781036656128606512,131072 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1888,i,757730231529023967,11781036656128606512,131072 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1888,i,757730231529023967,11781036656128606512,131072 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4768 --field-trial-handle=1888,i,757730231529023967,11781036656128606512,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f2bb7e22e49f436d2b92af266dc15e13

SHA1
be36b9f2ee9a5fea8bcb72824a0935ff262f8f05

SHA256
c3822ddee993bef987440ed9a5c42f6957a720f33a9ba44d9fa3860a5d7a5fe3

SHA512
82c87ef3b838d93c6123a951199044e71e2cdaeab2dac6269815f2a1525c89d9a6d79df5a6d6e1c6adbb6ca048dac0d783590b425ed53ed9f224638c8259115c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a530b4fe19697b6f6588ac704a5957dd

SHA1
efeffd3392c1c0d14d08a0c3716ab240a250409d

SHA256
120f3854f65ccbd944501b444dc1a5369d02dea44d0919e8cfed3a098154fcbd

SHA512
ee033e6453d235f6e35b4c2b3f9d65c4ebf976a9221efa3acbea5dd0b113e0923e17fa44c4ab99b98738084c2b0800733124f66c04feadf697b7d17b78bd40d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
5a4a29ae0ba8000d969b368c1e0dbb23

SHA1
d9f9f1cb8e43331ed461ef25c2465a2a5c5ac82b

SHA256
14e8447dd36d006fe6bd8b91f3ae922182e417418f9400104e8e1ae1fdb9d423

SHA512
89f7a12c8c30de9638f3cf02c9eadba4b0be6c033f1bee7e933020793d3f6200780fd815515d95f87746f1d29e756ef16272d0083685b1a5bbc3292baff40cc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cc4aef331f1b8a4626c4b8500a905d5f

SHA1
46557db2349f4381577b9ba4758857a9961fb7fe

SHA256
be6d8b2121762e4e2ac2f8e3a79ea61f75a5b2d043fd5f15a3745ed9bce38889

SHA512
c2a568e90a396a14c0299e138d8725574c82363a48d7b1bac440bf034fc8f1a6aef4f70f845905965f88d0c03dc7bbf559bce5f46289e36d3eb05c4e381de74a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
12c94cd25ac2c384346aed49ce1fc634

SHA1
db8dc2cf82a4e944a0cf6748c2500daaf9de6816

SHA256
dcc86078ca1876712d3e1f68fa465cd4b593eb7740639791a60ac21f98d41cd1

SHA512
af4b2ea502886f5b8ac26d4b087f1ed91443f8aaf02ba97ea93271172e063cb695026202ae8cbd2be46cf9dcf19c1d5f77c5b0e916f5e14e507326d712d9f4cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit