hxxps://www[.]c3claims[.]com/

Analysis

max time kernel
0s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2023 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.c3claims.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3552	chrome.exe
3552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3552	chrome.exe
3552	chrome.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 5068	3552	chrome.exe	15
PID 3552 wrote to memory of 5068	3552	chrome.exe	15
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 2972	3552	chrome.exe	22
PID 3552 wrote to memory of 3088	3552	chrome.exe	31
PID 3552 wrote to memory of 3088	3552	chrome.exe	31
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24
PID 3552 wrote to memory of 4716	3552	chrome.exe	24

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.c3claims.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dc069758,0x7ff9dc069768,0x7ff9dc069778
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:2
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4012 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4008 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3748 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3424 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2848 --field-trial-handle=1860,i,9169821660803704465,4025431492062063308,131072 /prefetch:2
  2⤵
  PID:1396

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f08a28bc84eed162b439f9cadc94d0b7

SHA1
fe5ca5a253f133811f192e1bc7458101ea59ab06

SHA256
d6bd50ee1e810d2853959b945747f36f7999d1c9c360e6cd40e796895fc7adb3

SHA512
2cdf07ab56c281bd73729ac07dddae02c15b77792d2577540dcc5330f1436f0afceb63940447289055e2545c3be779af102e5b43105b65c08b0f6b4caf4647a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cb0c70586b73eecbb35db6d8ae937618

SHA1
6360958191d393e35a33808807fa8edee378f207

SHA256
de14db8d5c4361d052b50775d687bb4265e0efce622600ae186d5c6f8eb47921

SHA512
d7fee2b7cbbff23eb2e0508bc8a02d9d1a7187f081f03b0fab6c6a307313ecd650589faebad6e29c9c2a38e6e24d38dda911e3173d43b4c622ece39bb85a1533

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
978d68dde4d8570589f5e145d13a914d

SHA1
9cd67ef3d5fac54c1684d4b08f10ecfe8fd2a189

SHA256
fbede8c2f9a4926813328da0556377600ff12190bdc87719a873c5f84a4e033c

SHA512
f86bafca1b3e116e056ef958de8a588388b02a8ad72cf179cbcb11b372156c2843626d8e1fa9689330374fa7eee684bddaee060c947fd42b648598923988d058

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit