hxxps://variegated-spore-a555a0ed09e2[.]herokuapp[.]com/b?y=49ii4eh26oqjid1hccojac1g6sqjedhg60o32p1o6orm6dp25gh748hq49k78t3g78niuqr1dlgn4q9echgncqbj81h6oqbedcn6oo92

Analysis

max time kernel
0s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://variegated-spore-a555a0ed09e2.herokuapp.com/b?y=49ii4eh26oqjid1hccojac1g6sqjedhg60o32p1o6orm6dp25gh748hq49k78t3g78niuqr1dlgn4q9echgncqbj81h6oqbedcn6oo92

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 620	4452	chrome.exe	14
PID 4452 wrote to memory of 620	4452	chrome.exe	14
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28
PID 4452 wrote to memory of 4328	4452	chrome.exe	28

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1a5c9758,0x7ffc1a5c9768,0x7ffc1a5c9778
1⤵
PID:620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://variegated-spore-a555a0ed09e2.herokuapp.com/b?y=49ii4eh26oqjid1hccojac1g6sqjedhg60o32p1o6orm6dp25gh748hq49k78t3g78niuqr1dlgn4q9echgncqbj81h6oqbedcn6oo92
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:8
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5100 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4100 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2668 --field-trial-handle=1908,i,12027575479472262277,3947509963852299512,131072 /prefetch:2
  2⤵
  PID:4204

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:740

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x498
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
8299e689d338dab345bc742c8ec05a14

SHA1
3b85a3a11d695d8dff99f56f969097a3ca3311ad

SHA256
1023391c436275b7a8b65d59463abb359446a877500f1c1d5266bd5ee51e91e5

SHA512
b1d0685f50be3e0f9908160eb992fdc0470cd461ca3f2456be6da009c3371b904f659dbd2671b06b95684933112f04036d46b8a2593d55862c8ce10f1ffe9a90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8647022eaac366ab857a21e991011417

SHA1
2cf0864751ab4b359a2142a37fae7bac74b7f0b1

SHA256
907b655091ab75637bb8fb6ef04f543d2be98de76be946607ed57c6af6475397

SHA512
0db67973b5c63bc06c7e29f7a96d7cc91186a888a272affb23acb75d5f707e1ead8ae400fa50c17f802de2e45b11fb753d2c1db99277e80b5c4f415523647224

Download Submit