hxxps://infoaustraliatax[.]online

Analysis

max time kernel
105s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://infoaustraliatax.online

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133424932338725451"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2496	chrome.exe
2496	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2496	chrome.exe
2496	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 3504	2496	chrome.exe	20
PID 2496 wrote to memory of 3504	2496	chrome.exe	20
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 4364	2496	chrome.exe	83
PID 2496 wrote to memory of 3588	2496	chrome.exe	84
PID 2496 wrote to memory of 3588	2496	chrome.exe	84
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85
PID 2496 wrote to memory of 3584	2496	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://infoaustraliatax.online
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff71f99758,0x7fff71f99768,0x7fff71f99778
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1856,i,16257747587082852361,15543216774549319705,131072 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1856,i,16257747587082852361,15543216774549319705,131072 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1856,i,16257747587082852361,15543216774549319705,131072 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=1856,i,16257747587082852361,15543216774549319705,131072 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1856,i,16257747587082852361,15543216774549319705,131072 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 --field-trial-handle=1856,i,16257747587082852361,15543216774549319705,131072 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 --field-trial-handle=1856,i,16257747587082852361,15543216774549319705,131072 /prefetch:8
  2⤵
  PID:3640

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
6728159c8fb9aa1c1257dcf0cc3ec49c

SHA1
2ee8f3493effd8e94459745e0acd699ee7368041

SHA256
334a2decf37a0c24b257b59a46ee7698c13a282c9a74f5052a18f63d8760f228

SHA512
9c053904355fcaf72af382a82936c0cce21e4da76f3b3dbec2e38aae92fcd64387e21a5f57480b9694b421f3a8bfb63dd62f402d886b50b1f4a096060e411f33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
98d9bd3a6c1cd723e37c27d3bfed09a0

SHA1
01870d56c982e8bdd4dd46b19f015b00865ab3ea

SHA256
1b2b218157432f05282d127e53c72eb0996090bd498c6737df049e12608193c4

SHA512
34d5f9f21c212014492ebe39ed002bd037c40a357757ba0f0c106cd7e6bbe933bc40d18dba7dc321caa392b713f0088b7bf9ed3d4b9e93b5a1dca0bd7de368e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
49ec3b720330f948c503043da9f0c0e8

SHA1
198ed801e4ee767288a5458d7b1698e1b210904a

SHA256
f8bb3853227be62a0bfb71ec2e6bf6cfbfc60ecf309d1d20dd9910a1d18c86b5

SHA512
ba5ac0a06ca1f8b46ed7f6ed14200e1376edc8b595c9ceb558c11338dc81ff4ee5d3801aa3d83d820e55861209f08072e7c624535ec35269db11d89a879712c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6a2384ce09857f846338ed373562c462

SHA1
37404cc3dd08d87d403774e52aedf1999ccc787e

SHA256
f34569f87fc0eb5a7b21231c6dcbdade06f7e04d4497b2292988f43595b2b589

SHA512
0379dfcb4f3340dee6baf9ed7eb542e577df6c6712826a48fc6fa0c699237f45dd6fb7b504b81c9997d720d6d51bcb5c9b0ad483a644d314f91f4ad737b40c5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f9c96226cf78ad43838720c3a75ddd06

SHA1
eadfc3d60c43da8d1029786a1e7cc874a587c121

SHA256
62d1afcd54cd62fd1f3f75253d949459b45350ee96dea7924f1f85d68c7f2809

SHA512
57c102861674296473b0172e6648f86998f6eb891e2631422d020521a2598601a1f7ca796e8bd3dfb8f0494ff076526e2166e076b23c56268667cf8cba452232

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0d1dd957c69447746823fe007ba32e88

SHA1
36ded7a59b46185f1b3cc7cc01f9d9b0d7be9d9c

SHA256
e41b7c31dc93f06bd808dcc73d0ee99dcd04f86120740cbfbb1f237f127f67cf

SHA512
d920cd4027732d69a7adf5c057ea3bc416c22e303e635578360ea5b145c3eebff8d43a3d1e0abcbc060fc3b7ec81d316ac70d85bfa40f6a684a49a656bd55966

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
15e419908a1e75ffd8d48fdb34a38ddc

SHA1
b22924a01d9b3ca3a72a0c080be9018c6311e6a1

SHA256
3f9cbeb6d66301d46d73970267c0e1ff612459458042e1a17d9317939579b359

SHA512
6f39c7a154f8a5fb3f3b5179259bac7d924ba5e55248c69cc136459d7ed076abbb56c1dd6a41745cfd9d01327709795c1b6d20be88d48e76bfddaf32538ec13e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit