hxxp://37200d558378885fa58df673f94a82f77278f15357b2a84028cff8ce19579175

Analysis

max time kernel
30s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://37200d558378885fa58df673f94a82f77278f15357b2a84028cff8ce19579175

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416392131815562"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4584	chrome.exe
4584	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe
Token: SeShutdownPrivilege	4584	chrome.exe
Token: SeCreatePagefilePrivilege	4584	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe
4584	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 2212	4584	chrome.exe	62
PID 4584 wrote to memory of 2212	4584	chrome.exe	62
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2880	4584	chrome.exe	85
PID 4584 wrote to memory of 2900	4584	chrome.exe	86
PID 4584 wrote to memory of 2900	4584	chrome.exe	86
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87
PID 4584 wrote to memory of 3716	4584	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://37200d558378885fa58df673f94a82f77278f15357b2a84028cff8ce19579175
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee0919758,0x7ffee0919768,0x7ffee0919778
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1860,i,16081292888346886940,8793173132569485410,131072 /prefetch:2
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1860,i,16081292888346886940,8793173132569485410,131072 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1860,i,16081292888346886940,8793173132569485410,131072 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1860,i,16081292888346886940,8793173132569485410,131072 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1860,i,16081292888346886940,8793173132569485410,131072 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3972 --field-trial-handle=1860,i,16081292888346886940,8793173132569485410,131072 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3292 --field-trial-handle=1860,i,16081292888346886940,8793173132569485410,131072 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1860,i,16081292888346886940,8793173132569485410,131072 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1860,i,16081292888346886940,8793173132569485410,131072 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4700 --field-trial-handle=1860,i,16081292888346886940,8793173132569485410,131072 /prefetch:1
  2⤵
  PID:2220

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9f21b319-e0e4-4a99-9fe9-57915c54622b.tmp

Filesize
103KB

MD5
60247ba208dbac141269d6bb96ab0b22

SHA1
7e1ff8a56c8331ee7bce403af3f3f064bf006f27

SHA256
aefdb7530090a9fc99b9e900e91899c5b07d516490294ce7dfdbdb6a215ffe9b

SHA512
38aa475d370ca505ea81a56926d9881b969fcc77e8b3452cf8454aa82ea5d9bd6cb98311193ea7e874b5a2844260e6f733c349bef6af0aed57a429119fc293be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
6ea2395155605734f3c9cc35981adb04

SHA1
132cd649d996b93016cfab63fd52be340ca6c5be

SHA256
1fcb6907a2ba18235d217c3e70f46508fe8e891ae296feb804d5f45d7827ec1f

SHA512
8bd0695acaf31f3ef9579baa26b3b144de5c998d6bd0a9a9937e4d0cb0b92124bfb1f5ad8fea0f6c07441a7fc47fe2e5dc126797b67ce91facac7d9896cb10c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
104KB

MD5
b988b29576c9c529fd59488d16a47201

SHA1
948531530d1d664d45eb399b075e81e8070cc320

SHA256
6bf250cff1f3b8743693706c87e3c718f2b176f92681cecc2b374986783b5331

SHA512
f44eed28f57ff6d32496d636ac2d8ec3350e2e24a944fc318b513623567d55a8558f2e2aa39494302eb95f868a22c3ef96d5d78d4f9206d9f4977ac424956090

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit