hxxps://lp[.]constantcontactpages[.]com/su/HivIZsl/nicklasnagengastbiopharma

Analysis

max time kernel
41s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2023, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://lp.constantcontactpages.com/su/HivIZsl/nicklasnagengastbiopharma

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133444667308875514"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4404	chrome.exe
4404	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4404	chrome.exe
4404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 3488	4404	chrome.exe	57
PID 4404 wrote to memory of 3488	4404	chrome.exe	57
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 444	4404	chrome.exe	89
PID 4404 wrote to memory of 3564	4404	chrome.exe	90
PID 4404 wrote to memory of 3564	4404	chrome.exe	90
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91
PID 4404 wrote to memory of 5056	4404	chrome.exe	91

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lp.constantcontactpages.com/su/HivIZsl/nicklasnagengastbiopharma
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd1309758,0x7ffdd1309768,0x7ffdd1309778
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1884,i,17935764869027637555,16221570344573435337,131072 /prefetch:2
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1884,i,17935764869027637555,16221570344573435337,131072 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1884,i,17935764869027637555,16221570344573435337,131072 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1884,i,17935764869027637555,16221570344573435337,131072 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1884,i,17935764869027637555,16221570344573435337,131072 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1884,i,17935764869027637555,16221570344573435337,131072 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1884,i,17935764869027637555,16221570344573435337,131072 /prefetch:8
  2⤵
  PID:812

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
7e3177327376c656d4356149ba1b7a74

SHA1
7d6ac8f99eec22dce6388776385c722c7cdcd3c6

SHA256
45b9a104033bc6feda0a184943b009f743076a1f589b31b341a2068796fe1e91

SHA512
1f42900d80c20595d2b94ced7ac0b0a12b433dec4da84e4c288dad3c7355f3803d5fad5280e62bce3cf90b5e897bc17d136826b84f6cf29a8d6ba9bf53b3c11a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
bc24de8a64e6b75fd1120330a0308525

SHA1
af49d4d0411c74af7c3e4216afa51cbdd973963a

SHA256
d2f735d7c831a65ffd6cca5e9d93b00ea86f9fcc52913a258463618271df320c

SHA512
cd6365baeb630e757c95ac492e49268adf4e7cd5074ae4307e0807f38b4b706f9e4681d531265164ca0efa709817e234c0ecfd312d022522eecec187f08a3200

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
be3a9ed735f2bd22ca00dd01316ab626

SHA1
c5541585d32d70fda22e26c348d50b790cd1a981

SHA256
87be4d949492001aa04e4dbfd10f005d7bd50677ca5c06537dd81bcb46d64e73

SHA512
df9858bee462d6f8d4c50456a571add0ad3d5c690fe0058b52ddcbfb6a3c23687971d8920e054c5c3f3f7109def0ec9d18e05c9ec1a6b3cb358ddbdd5daae21a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
86d31fa95d7bf255325d488ec275a883

SHA1
011cf7ac0652300385f087faaf0fb6b09f9c186a

SHA256
573ab835648445d911803593f76ce941b7276f33468c1ca06357e8a822b6bfb0

SHA512
abb259fcde116ab4c0eef7e99d1b6a11e4eb9eac5aac1b1c2f17dcf2820c09da127a6577de71f8fdab42b9f57708403fcd549006776fde20a91c4cb25dfd72dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
4ffaedef7293763951c281408c359db5

SHA1
c09deace9ad923b32a76d95eb03ecf0b2a11ac8c

SHA256
7e06fcccfdd25b6e77910ba5e3527070e5a1c8b2cdfd67d5d7b2f4ebe76c1e74

SHA512
3b787021a459c5eaaec0e4631fdc7cc33c4d916005e0a9b66550c631edaf052b31ad4e5e0f131faa59dda6f40192343be72b22501f24353ae1458d4f09419f02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit