hxxp://www[.]manageengine[.]com

General

Target

http://www.manageengine.com

Score

10^/10

phishing

Malware Config

Signatures

Detected phishing page
phishing

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133457406229776300"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

2284 chrome.exe
2284 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

2284 chrome.exe
2284 chrome.exe
2284 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe
Token: SeShutdownPrivilege	2284	chrome.exe
Token: SeCreatePagefilePrivilege	2284	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe
2284	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2284 wrote to memory of 5856	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 5856	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1692	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 4508	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 4508	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe
PID 2284 wrote to memory of 1520	2284	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.manageengine.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe86169758,0x7ffe86169768,0x7ffe86169778
2⤵
PID:5856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1836,i,7532916388691420193,4236419061312216331,131072 /prefetch:2
2⤵
PID:1692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1836,i,7532916388691420193,4236419061312216331,131072 /prefetch:8
2⤵
PID:1520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1836,i,7532916388691420193,4236419061312216331,131072 /prefetch:8
2⤵
PID:4508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1836,i,7532916388691420193,4236419061312216331,131072 /prefetch:1
2⤵
PID:1616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1836,i,7532916388691420193,4236419061312216331,131072 /prefetch:1
2⤵
PID:4060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4540 --field-trial-handle=1836,i,7532916388691420193,4236419061312216331,131072 /prefetch:1
2⤵
PID:3052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1836,i,7532916388691420193,4236419061312216331,131072 /prefetch:8
2⤵
PID:4296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1836,i,7532916388691420193,4236419061312216331,131072 /prefetch:8
2⤵
PID:4300

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
5ac6d929ebf8e4b7efa2d3cb86424cc1

SHA1
f29c6939957eb6f0ebffe8ead5814462df84afe1

SHA256
d03928eeae6859c4368e24390f3407e14922a05ae10f7931075b52d807ba797d

SHA512
9abb749c902a05629bee095c4153c901b40a2aff1d1ca232078eb68ea27b58a2f31ca1412ce98f794e361b9af88a8c8962e961f81bfbadf9c0d34a663c44e73b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
875B

MD5
0f2c27b152f93e613fbbbe101a994190

SHA1
8235fa8bb26ad049830312dab03c88d0298c6428

SHA256
12e065c276f0739c54efee6bdb6ddc27c5107477c9ee5218fd304641689703de

SHA512
e4d8feb31d623d98c27449bf9a354f6235bded18133f70dcdf0fd3c1868f89c3d0e08d6ad79ab8e8c7f495abc6a6ebc069f1e94eba8894fb594d6e4d2e8ef408

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
875B

MD5
3e23e32bac675b20839295f00f086f11

SHA1
baed669cca5bc0760b8a6a6720d3a5481574ff56

SHA256
5973432177b95638f024df53b2a7cef6eddd3014e017726859777071c0001895

SHA512
d39a1b79895af8af53f2891cd193009c682a8b6ab976b93ca8f1e7931e41980c8962af57fbb50ae57d94615ce5ddfdc6e7bc57b02ba7e8f12bf744702570b864

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
143dfab4ab57c6a6a46322c7df0110a0

SHA1
bb05bc75c9b15409853cfb19dc1818f4607ee9c6

SHA256
923d45fb0650b3a7bd1da48a8602b5d40b35e0cc39ee7e2e3cf787dc9581247d

SHA512
2f64ae644b5e342b48c845037f50c09c92077d3fed842c6c23fac62822d617a2eb4fa12d30b4cc0912e9281e22dfe3c0dca50161e88d1f1bbdc773697f604a7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
115KB

MD5
3452626d660defacc3fbbafe511fcf21

SHA1
76eca76e9b625b20795e611de304d762a642f0e6

SHA256
e6965d27464444d300ae85affbdc9a2ebe9357040b11abe7708894ba8c472811

SHA512
9990f519fa88abbcedbab69db8d91800b3cec02d2504e8bba63bb75a5a73919e82209be8e24ea74a71af3f9b0cc72a9be4832f28bb91ef1f559c43ac6221a590

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_2284_SOGJGMJVMYERAINL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads