hxxps://cdn[.]tryoffer[.]net/rdr/YWE9MTQ0MTI1MTI0NiZzZWk9MjIwOTU4NDImdGs9N0s2ZVNpWFdtcUl3QVRKQVhFaFomdD0xMSZjPTkwYXM4NzZmZDg5YXM1Zmc4YTA5cw==

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2023, 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.tryoffer.net/rdr/YWE9MTQ0MTI1MTI0NiZzZWk9MjIwOTU4NDImdGs9N0s2ZVNpWFdtcUl3QVRKQVhFaFomdD0xMSZjPTkwYXM4NzZmZDg5YXM1Zmc4YTA5cw==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133453125669622052"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
376	chrome.exe
376	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe
Token: SeShutdownPrivilege	376	chrome.exe
Token: SeCreatePagefilePrivilege	376	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe
376	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1468	376	chrome.exe	27
PID 376 wrote to memory of 1468	376	chrome.exe	27
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4996	376	chrome.exe	85
PID 376 wrote to memory of 4268	376	chrome.exe	86
PID 376 wrote to memory of 4268	376	chrome.exe	86
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87
PID 376 wrote to memory of 2844	376	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.tryoffer.net/rdr/YWE9MTQ0MTI1MTI0NiZzZWk9MjIwOTU4NDImdGs9N0s2ZVNpWFdtcUl3QVRKQVhFaFomdD0xMSZjPTkwYXM4NzZmZDg5YXM1Zmc4YTA5cw==
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83ff69758,0x7ff83ff69768,0x7ff83ff69778
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1868,i,9963156319996714456,648189250805786118,131072 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1868,i,9963156319996714456,648189250805786118,131072 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1868,i,9963156319996714456,648189250805786118,131072 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1868,i,9963156319996714456,648189250805786118,131072 /prefetch:1
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1868,i,9963156319996714456,648189250805786118,131072 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3712 --field-trial-handle=1868,i,9963156319996714456,648189250805786118,131072 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4724 --field-trial-handle=1868,i,9963156319996714456,648189250805786118,131072 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1868,i,9963156319996714456,648189250805786118,131072 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3412 --field-trial-handle=1868,i,9963156319996714456,648189250805786118,131072 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3804 --field-trial-handle=1868,i,9963156319996714456,648189250805786118,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
22912a554e966000f08cf7d7fd79c236

SHA1
c235747152e9a3bb842f5d6b63b4f5af6e75cfd4

SHA256
1631efcc3d453f58ea6e41d8d3ff3ebadd2593723493f46908a0d9c115df30ed

SHA512
73ff6b2b253b4fef3832ba55bf0b9b48edbab831d529e9f6ed8a5426a682bc95ae017843c5559b805fec5a8ec6be56045dafd7fb33d38be352ec715d8797649f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
edbbe8bacfd955903082b8617ac8a644

SHA1
e4c4eeb7eed72ca5443f6230841ad6c7f71cc8c5

SHA256
13fb6679cd307c4307e1edbb231d153f6ddd8ceec0d6576bcde71159d2d67c83

SHA512
ea25ee26539176bb4df7893dc06fc87f5ce515678a2a2965b00a7cb79a3c4e2a88ba42b4278578668b2706df7fbf214e2dab36ed1d73499c05d9ebe072264453

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8107f15ac01ba758d26a4dd2b2bd6d9d

SHA1
7d281a96bc5841a03ac856f25ed14daa595cb53f

SHA256
20106049ecf522f2414702e3cfab3b1e0c324ec3f9ae8017f849b821f2aa1e0d

SHA512
79de5b14ecf8638c4483c1a46dc5331861a18153af37ec5b2a2c3565359ee53282c18ad14d82542dbba466ad664016e4294182f60fe969caf4704106250fffd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b2c09704a9272c9bc9d6bd7129609f01

SHA1
d0470f4202d70984804a68a82849536d4759fb9f

SHA256
a02df6f7e67021c8c75eb6d981e16159d636179a4c2455b1db123d9d373f0a53

SHA512
8cf748dd0d030580e49a75a2e57207c40df33c4736215fbc38cffd7d9ba2f1bad58bd38dc4cca8de785203aac17663a80c745253bc982af2adc769bf7e5bfec2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0b78b6f15f09729cff348ee1d270895e

SHA1
737554236bf2b5b22e31a9e321478e031f41c2f1

SHA256
11a3788beb38d03ca14905ba3d2dff73beace4cfa790918390072a22963668f3

SHA512
599151164083a826cbe607258d4ed41b2b6394fa4e3ff037329e4d05dc3997b8ffd02817ec0acd66337d017d4d339a012c49bdd5a3f274d5fb4cdd926dcd0860

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
55e0cc2fb7464a26a2beefbe72564988

SHA1
ddaa520fcb69776be347fd378678c6bb636ffb7f

SHA256
d1509a871c85cfb0a69b1e7ca27098d85adfa8c3ec72508a4c3c70d0c981516d

SHA512
825cf84b040d37e73c934551456c03ffeb93ad6d1f247f01fd50e96e0f8ca54907b3dc304565614844c53219aec90e81f72ccd5a7575e86a168b899e40678a93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
2b9ac1201eac1372ab3714bb2330dd4f

SHA1
84ce0be17598a077a5d078356af38863061d4e16

SHA256
64c00a12911c3c9aea5217764dcfd1341ce501757c5f5d8b941731a138ee5ea2

SHA512
594f7dc2f8600f3917ddb9d9600a2c89cd6d185c42613cc1ba00ebe44af353af54396412c56522d438b75fde907f2862e5cf28d798bda4bdaccd0876ed46a5a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit