hxxp://www[.]ihateannoyingorange[.]com

Resubmissions

31-12-2023 01:35

231231-bzx83segbp 1

Analysis

max time kernel
0s
max time network
145s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
31-12-2023 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.ihateannoyingorange.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4384	3108	chrome.exe	14
PID 3108 wrote to memory of 4384	3108	chrome.exe	14
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 1952	3108	chrome.exe	22
PID 3108 wrote to memory of 4396	3108	chrome.exe	21
PID 3108 wrote to memory of 4396	3108	chrome.exe	21
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20
PID 3108 wrote to memory of 1668	3108	chrome.exe	20

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff3a199758,0x7fff3a199768,0x7fff3a199778
1⤵
PID:4384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.ihateannoyingorange.com
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2736 --field-trial-handle=1700,i,18155107165616632842,2714603451202394458,131072 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2716 --field-trial-handle=1700,i,18155107165616632842,2714603451202394458,131072 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2052 --field-trial-handle=1700,i,18155107165616632842,2714603451202394458,131072 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=1700,i,18155107165616632842,2714603451202394458,131072 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1700,i,18155107165616632842,2714603451202394458,131072 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1700,i,18155107165616632842,2714603451202394458,131072 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1700,i,18155107165616632842,2714603451202394458,131072 /prefetch:8
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4396 --field-trial-handle=1700,i,18155107165616632842,2714603451202394458,131072 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4496 --field-trial-handle=1700,i,18155107165616632842,2714603451202394458,131072 /prefetch:2
  2⤵
  PID:3180

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a44fb8c0a742a851b3305fb8829e045b

SHA1
0cabbb90beff06066d9d86771af8ed7c7230f4cb

SHA256
2ab81c72b82254616e8c832b5f9d5a46310ea4d1b6f6cd98b8da8b723c3e1c7b

SHA512
f4e3cb0944fe8f74037b64aa730862ec1be90bfe7e330710b25e4799897225c1def659464a9b1b63384da4f9eeaaf60a928152865735ad23173c0b8be059cbfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ee502c5c3d20e8b5d89cc2d9b34f26a7

SHA1
e13142e8ea98f9537bf9d19c1535baa6e8e7ca59

SHA256
1b04a26bcd172b4a09310b9cddba80bc0ecbbe994448b7d4ee282f82f4c8768b

SHA512
e6bf1873315d11d131987610d1059f1c209d91884b8a40373c2206ac713793dadbf9e69ba26f96a590b22cdba3fd101aa8c4d3377312908e95a13fdf7adf6fea

Download Submit