hxxps://cloudflare-ipfs[.]com/ipfs/bafkreid6vfv7qpux6dal3ttttq4ynltoxcn43z2rofyyidthvwybjwnnu4

General

Target

https://cloudflare-ipfs.com/ipfs/bafkreid6vfv7qpux6dal3ttttq4ynltoxcn43z2rofyyidthvwybjwnnu4

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133473561709039998"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

3036 chrome.exe
3036 chrome.exe
5016 chrome.exe
5016 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

3036 chrome.exe
3036 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3036 wrote to memory of 4640	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 4640	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 4800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 4800	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe
PID 3036 wrote to memory of 2032	3036	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cloudflare-ipfs.com/ipfs/bafkreid6vfv7qpux6dal3ttttq4ynltoxcn43z2rofyyidthvwybjwnnu4
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb48a09758,0x7ffb48a09768,0x7ffb48a09778
2⤵
PID:4640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1884,i,17289480672986724940,13223049509042159923,131072 /prefetch:2
2⤵
PID:800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1884,i,17289480672986724940,13223049509042159923,131072 /prefetch:8
2⤵
PID:2032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1884,i,17289480672986724940,13223049509042159923,131072 /prefetch:8
2⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1884,i,17289480672986724940,13223049509042159923,131072 /prefetch:1
2⤵
PID:3840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2912 --field-trial-handle=1884,i,17289480672986724940,13223049509042159923,131072 /prefetch:1
2⤵
PID:3592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 --field-trial-handle=1884,i,17289480672986724940,13223049509042159923,131072 /prefetch:8
2⤵
PID:4708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 --field-trial-handle=1884,i,17289480672986724940,13223049509042159923,131072 /prefetch:8
2⤵
PID:4352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4680 --field-trial-handle=1884,i,17289480672986724940,13223049509042159923,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
3b04d157553c895f7bb64200e0872209

SHA1
edbb980757243d5d222729e2b4aa46a181d5e3cd

SHA256
4ec6c3e57929df214fd2c69397dac98b27dbe23d819de765970b0e7d69bb161d

SHA512
da8aa498037a45f5d245596ed2825a8ce3674a5f1fde75171b06614a2603935e65a8ff8d8938ab98fbe8377e262ee2c9f6d589fc7c73f055d28069b44d51adf7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
53c21875f41c36aa7670fbfbc334bcab

SHA1
58daca1e9a5ec014e953bd673e84ad4241db97a6

SHA256
6e52f2d43941a02c2ff6755007042ac5616c0161f6ad86fdda3c89bdd993ec66

SHA512
ae73b024ca24880c534bf5b4b8bd5e00c721f8104403af7a45c14caa0a8dad7b7bb51cc7f386b8518d1e5ddf0cbf9ea784a35ac9179999903f8fe0e0393043b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
a8b0e74ce4da999ce7282e53add870e9

SHA1
cdfb94edbcd0928fa0a70835cb340bff31361c85

SHA256
805709d20f03b7b1a519faef7eeba8d1c0f8fa26722a2702149bc6573bac225a

SHA512
9eaa35e70cc7bffd228efedd4675e8643fb2de6239cc4f62115673ca48af21126f4625f1f4a1dacbc7f231db394220e5a989b856bbe527ac78bc5047c4299779

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c839e979-12a6-433a-9ed5-be4ee5d725c3.tmp
Filesize
6KB

MD5
ffaf1c9c6d29e610c0d0b7a5c366aea2

SHA1
494b7c3a47071303da784ab5a6b4cd30659d6403

SHA256
e800a57b61a495c6884b9933fdabac3eccd1e21c972e43a45f1c13b8d03d1c83

SHA512
f5066d6f2a7c3c4b29bfd54f3a26bc24e532c1d2f104847750e2e8e7a64a5ed534a783ab7e571bbe5276aab2b6fde4d1e9c873c0cbd18a34fd538819c11a609c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
114KB

MD5
6d98d54e439c330241960677e0f82817

SHA1
e218cb04d2505803f0c0326af349d5c2805df484

SHA256
5bbbd38f172e8ae60dee7bd1241661bc24bd7bbf7e8cb05a62c3f89dab32f625

SHA512
9bf606e9ca0f3fdfdd365fa89b0683bb17389cdb7b8b28b61bafe649a0327c68a631f8d19728e6586c4ec99e495520f877e5ced362d7f035315d7a1df5783f4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_3036_NUXDGYJHKOFRUMFN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads