hxxps://scangl[.]sharepoint[.]com/[:]b[:]/r/sites/SGLManilaSharedServiceCenter/HR%20%20Forms/Offboarding/Employee%20Clearance%20Form%20-%20v2023[.]pdf?csf=1&web=1&e=RyCCzm

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://scangl.sharepoint.com/:b:/r/sites/SGLManilaSharedServiceCenter/HR%20%20Forms/Offboarding/Employee%20Clearance%20Form%20-%20v2023.pdf?csf=1&web=1&e=RyCCzm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133425212560373284"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe
2028	chrome.exe
2028	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 2016	3248	chrome.exe	67
PID 3248 wrote to memory of 2016	3248	chrome.exe	67
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 4284	3248	chrome.exe	87
PID 3248 wrote to memory of 2224	3248	chrome.exe	88
PID 3248 wrote to memory of 2224	3248	chrome.exe	88
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89
PID 3248 wrote to memory of 1076	3248	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://scangl.sharepoint.com/:b:/r/sites/SGLManilaSharedServiceCenter/HR%20%20Forms/Offboarding/Employee%20Clearance%20Form%20-%20v2023.pdf?csf=1&web=1&e=RyCCzm
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd286d9758,0x7ffd286d9768,0x7ffd286d9778
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1864,i,1401922603341713250,12127971139368791613,131072 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1864,i,1401922603341713250,12127971139368791613,131072 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1864,i,1401922603341713250,12127971139368791613,131072 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1864,i,1401922603341713250,12127971139368791613,131072 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1864,i,1401922603341713250,12127971139368791613,131072 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4532 --field-trial-handle=1864,i,1401922603341713250,12127971139368791613,131072 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1864,i,1401922603341713250,12127971139368791613,131072 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 --field-trial-handle=1864,i,1401922603341713250,12127971139368791613,131072 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1864,i,1401922603341713250,12127971139368791613,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
9a5f31829e514d68ebc09b37a01075ee

SHA1
fce7dee0bff6cea744fc3a0d4caf25f67c86dc9f

SHA256
9504172c5574645a013dd3c506c36c4b98bb1df95cc20bf693ea46efde287f4a

SHA512
4f174e99139fcd801c7f25db9c8b3333f3cda1db740abb3fa59ef732dc492484e0655d89988139a82701b05ff71140d6a4647b034970878bef56835a590a0da5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a8f6fae25149c3b33669ccf21a2bf105

SHA1
85d2eca65d7fcbb4cd0969b2132382661acbae70

SHA256
b014070ea323d5a35fcb8dfbb7f5da7998e0176f413f0f48b573e2a9fbed91a6

SHA512
e4dcdbe57bb5fb81bb4ff008dffdaceb7eb9189c2d52579805215cd8c69027c70ff4df9552898eb1d88ada35d4be05b9b6474d8181606cbe463ba0a4d8aa50ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
4054e236b2fa141056708c2745dbbb59

SHA1
1fa8115de062b4f766489869aaa2223bb6551332

SHA256
373c543073fe86fdf8ee9bc7f4902f2ed8c1b6730b2107215b3cc22e59f27fb4

SHA512
7bcec8283cf0365564a157986ed1d9ed1bcac7756159bc9f8f99c074ea0776d29ce672c3f5db57f4a508b7721e1d2ffef57597ea0198c1cafa5856dc6bbfe1df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b2f6d5f83a82ae2c94f5ba5abb6cbad2

SHA1
9a9f39b7515bd70485e1d5bacc64fec6f14b8d42

SHA256
a95687c0661c292b1f8adbd21de7309815dde85d668638fee4f36f43124970be

SHA512
492dfee8e861c358185ba3f532106bc43345950e6639ac15bf4bd592cde3a29f67c4882c85939a8bd417fe4a62f91a53dd7cf599306242e17104ebd644a24a9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
9e7db06c607082f115cf43b086e0bc7d

SHA1
12682eac35e1ab4def55e606842a1a684c4d0b88

SHA256
e6d2858e1959df86ad7bd01581da31fb4e4ce99c2d06dd9b2310427020e56795

SHA512
9dd6ccd77d0a026ff8ce3ec7adaaae819ad10eab785ad5f56545a73865c1014e931f5c79a53a8794d1f9ffc5ac87cc91fa73cadcf8dc4edaa06d65f65d384da5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit