hxxps://raio[.]hadedynamic[.]co[.]in/campaigns/vn864pdyr47f8/track-url/dc5204mynz8b0/b28a03d2e2ce31b476191d38b55e42eedf61c90f

Analysis

max time kernel
59s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://raio.hadedynamic.co.in/campaigns/vn864pdyr47f8/track-url/dc5204mynz8b0/b28a03d2e2ce31b476191d38b55e42eedf61c90f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416542707918831"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4084	1280	chrome.exe	84
PID 1280 wrote to memory of 4084	1280	chrome.exe	84
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 4800	1280	chrome.exe	87
PID 1280 wrote to memory of 3624	1280	chrome.exe	89
PID 1280 wrote to memory of 3624	1280	chrome.exe	89
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88
PID 1280 wrote to memory of 3828	1280	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://raio.hadedynamic.co.in/campaigns/vn864pdyr47f8/track-url/dc5204mynz8b0/b28a03d2e2ce31b476191d38b55e42eedf61c90f
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94f539758,0x7ff94f539768,0x7ff94f539778
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1816,i,1221792919271083290,8934447812781808008,131072 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1816,i,1221792919271083290,8934447812781808008,131072 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1816,i,1221792919271083290,8934447812781808008,131072 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1816,i,1221792919271083290,8934447812781808008,131072 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1816,i,1221792919271083290,8934447812781808008,131072 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1816,i,1221792919271083290,8934447812781808008,131072 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 --field-trial-handle=1816,i,1221792919271083290,8934447812781808008,131072 /prefetch:8
  2⤵
  PID:408

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
269554b174391a0ed89f46b3f62e5ca5

SHA1
9a546548a5d569137c235116707af8ac719755ab

SHA256
53a271e72872098fcf8a32f547b45a7cf0cc9aa429ca71cfbe7431e96548eeeb

SHA512
ccc73a699949748dae5f5fbf9626ecde0d62945a32a320803bb1c23315fd5070755e4c615bfd769dc79d69f4d3c79e1f07d41f1559c417de52ecea0d970e88b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
07656b3249c5e32856b2b55514c257be

SHA1
365b0d28a63aea7beeef4b18b55b09468569d7ec

SHA256
af0d4422f4cd9d997dcd3f712b8c052f58441c296c75267b9c0ce40bfbfd2f1d

SHA512
b03821bae2afe3aeee35af18c75fdfc80105270b17c315de268702278f5411c12b00868676beb3839db30ddf5c693ae74cbde2691a1884045d3242d4c970a0f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
5ab866c8591391c769f4e649a61eb6f2

SHA1
5c5be87b8cd60376cc73eeb8e774815e888368f6

SHA256
630b56195f8aaf4ad5e25c9ea474674fb6ff06b865d39cd3f5b71534b1a34282

SHA512
e52db9c54847d1da7de42ee7ead8dd73aacaf4a86a5ddc48f3ab011f3fe4b335fd6fd39067be2dff36b48adf3e27b5dcb1f9fc498aec46ab3ab92953452d1244

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
3a183fd6b7c43768c35b966e914b13f5

SHA1
d2615ac433b8617366d5b01984f636578f8cbe68

SHA256
eba26fa6941f7126215b28a84429c2fee160ce2781a60ae8b79d51d6343b07de

SHA512
51229cef2a91967a950ae3378d530d353bfea1ccd4f59522e7cf5eb94e76270746dc61d64589b2d96fc7a69014dccd1e4c30e8635cc1ff10fe30b1c44733e657

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8d98e723703615adb49f062a6aa36b23

SHA1
860f45b2dce5242e3faa5bcba290d35280865ebe

SHA256
b6354a16ef7ff518a3b6806ffe51da10f256f192f40d70e333222e3c1f1f83ec

SHA512
3144586b22e536bcca6f833a3b5364c3808ef8416ddf790c4b304431bea4775d694b483d729351c798e3652241466f317fc06f2a013bc29ab312612eb17bcf85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fc6506061d60da99bcac21b7a03d65e6

SHA1
34d2430839ff90b7b73f09ef7b4d142a5dde1167

SHA256
da34ed87ce6e7f648bd5b25838bad52b37e2bf5a74eabeb306f49df4d6a29e52

SHA512
98d67c6231c2c972116185a2928a81a8d0d9ce3e10f34806c7d09e4828639f86cd4e0f89b3ae1ebe99eac70c9ed79db7260ae2e058914030a457a38e60ef1aed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
5726a0c7c569ed60edf91da3a57ee2be

SHA1
68ed69148b24cdb631f78f040b4f5327ea502822

SHA256
54b60c11f8d88f5c7358154bb074299cee5f3b73a24ab7b2aec3010ffec254f6

SHA512
8d5fad70efb98cd688da9ff122b8aeb17fb5f1da627eef27d757a3545d9e6ca42688905abbaffc8f611b0fcdaac0f4b2ded065589a1712f5d5d30381d52af0c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit