hxxps://bit[.]ly/47y1W9I

Analysis

max time kernel
25s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2023, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/47y1W9I

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133454691959635889"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
316	chrome.exe
316	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1744	316	chrome.exe	61
PID 316 wrote to memory of 1744	316	chrome.exe	61
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 3512	316	chrome.exe	87
PID 316 wrote to memory of 4872	316	chrome.exe	88
PID 316 wrote to memory of 4872	316	chrome.exe	88
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89
PID 316 wrote to memory of 5096	316	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bit.ly/47y1W9I
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd120e9758,0x7ffd120e9768,0x7ffd120e9778
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4580 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3200 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5192 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5064 --field-trial-handle=1704,i,13201626956969556723,17429058491696305589,131072 /prefetch:1
  2⤵
  PID:3416

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b500ac5ec6ccfdf4a431b4460ac406a8

SHA1
3a798c56a2b7d3afb6021cfee62b3e0879e8c1ef

SHA256
2dad6038ce82398172b29e5f442ee0b193e16b34614148141631bf15abd58079

SHA512
87755f1b52ff000909f9c83b7181e18e99c86a2a7d090f314c4e4181b0a8617bc2d8df3d9e3e0269310f2837539133fca96fb2ca7c8dc9817cf8027fedd35b9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
871B

MD5
85d569571429e315c593659a439d502f

SHA1
ee1680ceef6ab50fc32bcacbba56de5cd1b2af67

SHA256
e9d606d2940ca0e0be3805159c68295b4b15637ae1751c682e76cb81920aeee2

SHA512
7e66d755d016c75a1349d592fc343c722ab9e3e2c280667f0bcc4a0c40c72e25b0361ca167cb077477cf604852c62e5b9a5a2d74e03a915b9abb24b752a73d1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
aa3914a485455b216514f82ae2b06b02

SHA1
80bd6915a67115266fc503c339eac6feb42a935e

SHA256
1fb0fdd84fa8cdcfb6281774a2faec9aaeeb8a0d19c3eacc3ee4b69d3feea7aa

SHA512
3a960fda70a593437dcd23f171c5abef4036c6fca49e535e8159c6b9ee312ff4fc12b5a1f7212ec870219f2f9ad95c8e5bd355f2216b100bfc1e73c27a0d1c92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
dae063f86cc81c91dfd438cca5da3d10

SHA1
cd60e0f3ed0d785a17e5cdd710a06f80b6541830

SHA256
413940827077cf7a2b53ab7d964b08a92c7401d2396b522e2ac3cce9815ba438

SHA512
2f877cee87839db31fe7a2686266c0a1d9afc430ca529d76054b8b92827502b216353db5736ba8d0e643b6e4817fb4f1d24f427d499f396e21e1fefeedafed0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit