hxxps://mygov-refunds-au[.]publicvm[.]com/ret/aus

General

Target

https://mygov-refunds-au.publicvm.com/ret/aus

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133464586339569965"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

1624 chrome.exe
1624 chrome.exe
1740 chrome.exe
1740 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

1624 chrome.exe
1624 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1624 wrote to memory of 1592	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1592	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1672	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 3368	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 3368	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2736	1624	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mygov-refunds-au.publicvm.com/ret/aus
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb9639758,0x7ffeb9639768,0x7ffeb9639778
2⤵
PID:1592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1864,i,9986908353340392217,1723954108126785706,131072 /prefetch:2
2⤵
PID:1672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1864,i,9986908353340392217,1723954108126785706,131072 /prefetch:8
2⤵
PID:3368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1864,i,9986908353340392217,1723954108126785706,131072 /prefetch:8
2⤵
PID:2736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1864,i,9986908353340392217,1723954108126785706,131072 /prefetch:1
2⤵
PID:2240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1864,i,9986908353340392217,1723954108126785706,131072 /prefetch:1
2⤵
PID:2688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1864,i,9986908353340392217,1723954108126785706,131072 /prefetch:8
2⤵
PID:1744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1864,i,9986908353340392217,1723954108126785706,131072 /prefetch:8
2⤵
PID:4276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 --field-trial-handle=1864,i,9986908353340392217,1723954108126785706,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2084

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:3028

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
0d8447d2e47ca40adec71a870b2333e8

SHA1
2d66df1e729b59c931756bd965a9d9c671a8165f

SHA256
314529ff20daaa37891c575349c72ee888e48f6f7336b9ffc2c241a51d9d1394

SHA512
a0e0d818a438fca84045db1a81770325b9b06905f9b4d944efce773f23da00bd60d7307f9de168e79bf6f8f675d62d561e3d2d0483f51dae0fc9d8d23fe8fe2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
45c55934db76397cb8ea919334064bc8

SHA1
3a5f3c8313cbe7b915b2f194e8d4935b917f5b7c

SHA256
e7d50f95214a877675b2d96400ede58f973d12fd15d28c39b759c47427dff195

SHA512
21e6ffd36bb0878d77a6968a6cf5c40770a34297457df4db936dc968405c35ebbbc98aaafad77b579fa097e5adbbedcf9150bac091b3d24309370b55c6fe17db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
115KB

MD5
3d266bae6a421e0b17f92add69988af3

SHA1
f69d6c4f397326504ae9d8d980402f71e451726d

SHA256
3570ca51848bf6e8a980793ad6d2af701a0facf23601a8add004c6e992cc084c

SHA512
7c28d71ff00b5d2272631f57a0853cd38a11b8bd27a9ed081dfdd418315facb12894992247c289628e32618b03fb9894b8aba4fcbf70babd9d56c33ab36722a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
memory/3028-65-0x000001E08D840000-0x000001E08D850000-memory.dmp

Filesize
64KB

Download
memory/3028-81-0x000001E08D940000-0x000001E08D950000-memory.dmp

Filesize
64KB

Download
memory/3028-97-0x000001E095C70000-0x000001E095C71000-memory.dmp

Filesize
4KB

Download
memory/3028-99-0x000001E095CA0000-0x000001E095CA1000-memory.dmp

Filesize
4KB

Download
memory/3028-100-0x000001E095CA0000-0x000001E095CA1000-memory.dmp

Filesize
4KB

Download
memory/3028-101-0x000001E095DB0000-0x000001E095DB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads