hxxp://AMAVIDAR[.]COM

Analysis

max time kernel
299s
max time network
282s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
13/11/2023, 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://AMAVIDAR.COM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133443374658134607"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
4220	chrome.exe
4220	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4020	5068	chrome.exe	16
PID 5068 wrote to memory of 4020	5068	chrome.exe	16
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4168	5068	chrome.exe	27
PID 5068 wrote to memory of 4940	5068	chrome.exe	22
PID 5068 wrote to memory of 4940	5068	chrome.exe	22
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26
PID 5068 wrote to memory of 4500	5068	chrome.exe	26

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff83f589758,0x7ff83f589768,0x7ff83f589778
1⤵
PID:4020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://AMAVIDAR.COM
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1840,i,2195770879818618540,12237064899932077348,131072 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2616 --field-trial-handle=1840,i,2195770879818618540,12237064899932077348,131072 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2596 --field-trial-handle=1840,i,2195770879818618540,12237064899932077348,131072 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1840,i,2195770879818618540,12237064899932077348,131072 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1840,i,2195770879818618540,12237064899932077348,131072 /prefetch:2
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4332 --field-trial-handle=1840,i,2195770879818618540,12237064899932077348,131072 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3828 --field-trial-handle=1840,i,2195770879818618540,12237064899932077348,131072 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1840,i,2195770879818618540,12237064899932077348,131072 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1840,i,2195770879818618540,12237064899932077348,131072 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1840,i,2195770879818618540,12237064899932077348,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
1ccf9a4f296df622b61863aae8d3187d

SHA1
a99f8f5ad8ef78e2df9e0d0ec6549f91cbd2e722

SHA256
c2e50968885b754dc2eb4186ff288b0421e04b70ba5a14d9c89f76f17583bd67

SHA512
b48984f595ea7ee4c3fd3a2006f13180ddc37536de763f821fc87d5e40eddd2cb6072e25f88fa0ff855f22d13c41c947a739dd36b8b628fcbf45814a815f29fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
45ff837dc753b91fda7debd3bd946ea9

SHA1
da481136223b93aeb0b73159039aed8b9d696390

SHA256
de8c1675e23cc0774cee1878b0556a13a7faf49a24d12a2a891f8f7575ed56f1

SHA512
e6f6a979fbe5e4e5d2a11f1d8e6bb4bf06f8b01e094bd8d0840fd15ac8d26bf61b3d98142f54782320475735c913682bea5c582444ca055d149c683174cbf0ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
c7a848c5c1deacad468bf105f7e9d1bd

SHA1
9f632039fd7910255b4b55d0ab1f3cd711c10d63

SHA256
a148839c8e6ce648bd57529b75c7509fc208b06bd08ecdbd9796f01211aa80d2

SHA512
2e81ee7cc2d6ad5478f673df5889ede61c238aebb711ac1d5de4652997bfdc14d0093759b3643a72fbc8aa1a4725dac6ed749b7467d573c60f25baca1a2c6848

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
ea5494180b8f294026674742129a93c4

SHA1
d55bd2009ef01ed22175017a742eafca755e52f6

SHA256
bcdd4ea74e96bbdb85d54da2e2075426359af3ad89a40a6199b83368397b6406

SHA512
f9e497350c2fe6062a905e6b91b75f2ab2cd8aaf2cbf76934b6a47d34d66a058af076280f38d417c88aca48485d8a5fe0680a21505e78b0a3a8f4b694493e8e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8d1f6083b13b9269395dfb0249545f6f

SHA1
976fe52e3c90f99fe4adb98356ce930e0e150793

SHA256
8049aa53ca4019ffa0578f746ca2095916065e318c50c580fda885a16e60ac73

SHA512
5644b6bc691e7de758802daf5d92c4aa7a13fdb71cf43acaefb3bb6d1758384421bdb3d831367e222f7d566855fee25bc97035dc54d01fff058f8ab7bc56f077

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
374048e9996efcfbfdba03a414583a74

SHA1
597339466bae3c6a743e856df5f2943d8e675fca

SHA256
0c176f6f68ab3fee48e8e223421c338490b6caeb8b6c40368a00e86e2ed9d2a4

SHA512
bceb7df5228eea28240d6312d45204e5bc915c9ec50ae605149e10187edffb37da2bcebad858f84aa74497c855ac82f8db1faece159752730ac8f1f98ef0a0c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit