hxxps://tg[.]news[.]getyooz[.]com/c/029ua3QWA3-SYHkgXYxvsb1AbwntTg84lwwSl821ynj86Hy8AXO-LUYzjoEckngT8QjDdc8TDlRh6j650Ye1x75Rgrsb30xKZE0u2yziWEUJI

Analysis

max time kernel
0s
max time network
133s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
03/01/2024, 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tg.news.getyooz.com/c/029ua3QWA3-SYHkgXYxvsb1AbwntTg84lwwSl821ynj86Hy8AXO-LUYzjoEckngT8QjDdc8TDlRh6j650Ye1x75Rgrsb30xKZE0u2yziWEUJI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 212	5040	chrome.exe	14
PID 5040 wrote to memory of 212	5040	chrome.exe	14
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 2524	5040	chrome.exe	22
PID 5040 wrote to memory of 4764	5040	chrome.exe	21
PID 5040 wrote to memory of 4764	5040	chrome.exe	21

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdc22f9758,0x7ffdc22f9768,0x7ffdc22f9778
1⤵
PID:212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tg.news.getyooz.com/c/029ua3QWA3-SYHkgXYxvsb1AbwntTg84lwwSl821ynj86Hy8AXO-LUYzjoEckngT8QjDdc8TDlRh6j650Ye1x75Rgrsb30xKZE0u2yziWEUJI
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2848 --field-trial-handle=1844,i,3969127894396076766,11299946428070543302,131072 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=1844,i,3969127894396076766,11299946428070543302,131072 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2060 --field-trial-handle=1844,i,3969127894396076766,11299946428070543302,131072 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1844,i,3969127894396076766,11299946428070543302,131072 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1844,i,3969127894396076766,11299946428070543302,131072 /prefetch:2
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1844,i,3969127894396076766,11299946428070543302,131072 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1844,i,3969127894396076766,11299946428070543302,131072 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5116 --field-trial-handle=1844,i,3969127894396076766,11299946428070543302,131072 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3080 --field-trial-handle=1844,i,3969127894396076766,11299946428070543302,131072 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4440 --field-trial-handle=1844,i,3969127894396076766,11299946428070543302,131072 /prefetch:2
  2⤵
  PID:6588

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
875B

MD5
2b2f785e2fe44d026629c76acce201ab

SHA1
f37b5f9e06c87e685be34d4ba3f9b922916c1f9f

SHA256
4e812e04d29c9bd7839a1febc28706bede19dc40f5e4b843e6eb90358b004332

SHA512
72da5708f4621218a1ef5014dcdb21f2e372fadb7b3234736d0457a558e96ce768450bca9d8ef627f0a824eb059cff6bac46b31f0a77d86e33af6b0565e533aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a13e3620-2f56-4c33-bfd5-4202841f3962.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit