hxxps://www[.]google[.]com/url?rct=j&sa=t&url=hxxps://compaslim[.]pl/new/xjsaqjxrrgyoksp&ct=ga&cd=CAEYAioUMTUyNDcyNDUwNTk1NDY2MDE2OTAyGjkxM2QwMjcwY2ZkMDBmMWM6Y29tOmVuOlVT&usg=AOvVaw2n-7WxTBIvF5ap6xLQc3vZ

Analysis

max time kernel
0s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/url?rct=j&sa=t&url=https://compaslim.pl/new/xjsaqjxrrgyoksp&ct=ga&cd=CAEYAioUMTUyNDcyNDUwNTk1NDY2MDE2OTAyGjkxM2QwMjcwY2ZkMDBmMWM6Y29tOmVuOlVT&usg=AOvVaw2n-7WxTBIvF5ap6xLQc3vZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2328	2300	chrome.exe	14
PID 2300 wrote to memory of 2328	2300	chrome.exe	14
PID 2300 wrote to memory of 2328	2300	chrome.exe	14
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2684	2300	chrome.exe	23
PID 2300 wrote to memory of 2232	2300	chrome.exe	22
PID 2300 wrote to memory of 2232	2300	chrome.exe	22
PID 2300 wrote to memory of 2232	2300	chrome.exe	22
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18
PID 2300 wrote to memory of 2688	2300	chrome.exe	18

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7099758,0x7fef7099768,0x7fef7099778
1⤵
PID:2328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/url?rct=j&sa=t&url=https://compaslim.pl/new/xjsaqjxrrgyoksp&ct=ga&cd=CAEYAioUMTUyNDcyNDUwNTk1NDY2MDE2OTAyGjkxM2QwMjcwY2ZkMDBmMWM6Y29tOmVuOlVT&usg=AOvVaw2n-7WxTBIvF5ap6xLQc3vZ
1⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2260 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2252 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:2
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2980 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:2
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1348 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2476 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2740 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:1
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3540 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:1
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2664 --field-trial-handle=1208,i,13675335339385655248,6111634202024509081,131072 /prefetch:1
  2⤵
  PID:2384

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
014eb16fa34ef6185f270803fc48b969

SHA1
9cee9dc06283e9bf0ca704581467bd409dee0dd9

SHA256
5ca11ed57d3bfcd209efe3f89aab8d2cff24764fe16d50125920e1c661e991e5

SHA512
ec7927dde1601df835cdae2abafb4924620ee13fcfbfbe3b229e2be4e26b339a3262648f1631171e4c11e4337367aa65d6f5fd1a7b66a7301883a632b5ee3729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8011b850763380837e73bbabac110f2c

SHA1
807715853e81bbaa4623df59201d04b627987292

SHA256
65299813a9b31105b83f8e3e1f63b3e485c9f0de3fea548bdc42e993663e0118

SHA512
08b0ea22bfcd7cb562dd4644ee4b73a6fbc9f57a67f1273d05136fd54f21c27f85e3f7d7040d3cc4c7dde851b844555343c76293a5f8a5009fa47ee569cd4ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e098ece866fbf69748a4c8a343796e1d

SHA1
780aa039a5ec05cd17053996a38c6aac49e814d5

SHA256
dea1746cf2a557a43e9e1435bf557dee5ca04507d6317ac1ab861ee5caefbb68

SHA512
aa5eec13a6816ea55fb2a5068ce5f969f948f4787b6441b8db365aba7a8a14b4c783a034ff1a610d5c19d7c9e081edf9065f04e6a9995de7d6bea48f7af9a161

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1055b439-0b80-49fe-b8d2-04b3b925d8f7.tmp

Filesize
4KB

MD5
e25238f54ad64fbbb62005f2055cc806

SHA1
75fe24765d387abc20f2e849fad44d3ccd5e72de

SHA256
edba230e22aad37480f7447e2047961097bb16682a098e97d0dc7d49d5f436e6

SHA512
16e3117be2f48706ab0cbc67234646b7b9bab0a1bf29b6e59c2daec39e9f64676860621223d76357b192c09b1fd3318842e07f9f025746c183857145326e262b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
22KB

MD5
f7a978ba912adc9054f0a6ae7adb5993

SHA1
24e36d1db706ee68812c6722c82d6f163a078808

SHA256
b3f813e6a5074a8dea9d5fbcafebd6233c933b85ab79f7d8c1e808712e08038a

SHA512
bcf9f27b05d1fe9fc50f8f4d08d9265115e304caf0900bf43f411ad32c99ec90ae06667b65f759586e01f1b9067b9f1c083385a6f139fde5d80edaf88482a761

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ca4d1f9e1919b7d8bd9603083d1c2aa4

SHA1
e8bd63559469f1590e9f0d83874747e873b15e55

SHA256
d462e3994a9073fa2cb0576d8f14a3e67ec6735778f502111a4ef433e1e8255d

SHA512
46e2fc66461ffbfcaa3d990dff61be4de491ff477fb19f1c265f571361706d41353561613f41ac5b83cac122d29782ba0032d262f82c32628c7bb744d9f07914

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
41KB

MD5
f823685f8ff1b6cc35d1e63382825044

SHA1
cfcf17c2dd892f69b7ebe026cff9e60b36d522ef

SHA256
cecd25bdd661c3deeadcb1d5dd520bb6860d01b047423143f8a14e00b2a9188d

SHA512
4c1384be4c13b6e355ebe51e20ac2c59cb026ea810c07513c117c054b92a061db8a5cd723e9c9e126f7af6273995b714d0fa3871d47e89f560b7ea2ef152a89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22FD.tmp

Filesize
57KB

MD5
d79bd9a87ba833afbde19e860565d239

SHA1
2efc04c76b35e44c11369abe80603e18949f80fd

SHA256
9d08a1504cb073b38cc51956267781656a2a2fed207b443f976c90df31a480c0

SHA512
c574d224cddc6fe0d2199d64d4e4bb5fb6dbb176a57f5c03d7b8c7e4dd79ea30df174c4c73a80f73896e4b209a51e59caef7475346a827c4bfb7850873e448c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2409.tmp

Filesize
56KB

MD5
0273dd382ffd20dfcd4f3b688ff316cb

SHA1
fa95b6cc6438472d6bfe9c574f230cfede2b3cf0

SHA256
ddf2d38290be76b15521411c18efb8b73a28750c82f0cce2f4e7f7fbe3a53120

SHA512
065b7fa7893d7ddfa995185fb1eb0b9502435a986b619272e7986caf332a4dcb8639c5efba932ad1b8e5b58263d9554cf48fcec91d8981c3d406bfb51a5a46db

Download Submit