hxxps://erp[.]ivyacademicnetwork[.]com[.]pk/vendor/repos/?themid=scatolincleiton@johndeere[.]com&file=1

Analysis

max time kernel
157s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 09:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://erp.ivyacademicnetwork.com.pk/vendor/repos/[email protected]&file=1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133488327267513023"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2036	chrome.exe
2036	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 4260	2036	chrome.exe	89
PID 2036 wrote to memory of 4260	2036	chrome.exe	89
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 928	2036	chrome.exe	92
PID 2036 wrote to memory of 2116	2036	chrome.exe	93
PID 2036 wrote to memory of 2116	2036	chrome.exe	93
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94
PID 2036 wrote to memory of 3816	2036	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://erp.ivyacademicnetwork.com.pk/vendor/repos/[email protected]&file=1
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9af4b9758,0x7ff9af4b9768,0x7ff9af4b9778
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1872,i,5371714088788000297,16161938162241696033,131072 /prefetch:2
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1872,i,5371714088788000297,16161938162241696033,131072 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1872,i,5371714088788000297,16161938162241696033,131072 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1872,i,5371714088788000297,16161938162241696033,131072 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1872,i,5371714088788000297,16161938162241696033,131072 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1872,i,5371714088788000297,16161938162241696033,131072 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3796 --field-trial-handle=1872,i,5371714088788000297,16161938162241696033,131072 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 --field-trial-handle=1872,i,5371714088788000297,16161938162241696033,131072 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2812 --field-trial-handle=1872,i,5371714088788000297,16161938162241696033,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:564

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
339c02ca7d2aca6013a6a3f1f124f028

SHA1
74144a7e024beecee9576bf0e3745d8801082a60

SHA256
5e209a1c67679747ab06a9d77b85011745bb58d67526c6b0e650281618c20ac6

SHA512
8e691d7984d5e74b381d99be45e463f016e6339448e73199a44c37bcd1b421a85c265be26216558649559ab5a192b13852f0f4559631c80384a057f3f5e85fcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
87c368dfefd5418e2b684369b06a5540

SHA1
b1cd1459975d6fbfb5d80a55a77dab8d9653e63c

SHA256
6b083adf16642861103d373a9ab9cd9f42006f19215c19cd6dd0c4f89e319ccc

SHA512
f3524a79ad49676ef240e1e59b9b48bd596fb99dde4ed265c6ee26f6c9e0780dec47d33ece52478c7aec041335a4ee4eb6fb8d262f76fd420226f6ddc3010cbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9743fb853218edba6e68917085be5820

SHA1
c18a73457bc846ba457767a9c97cc99aebcbf505

SHA256
7905dbf42f71afb6da30636e492be0fb5a62c6aff95b1ed7ba1fdc62226ccd15

SHA512
cc7d666ff06a76b57d377d398ba5b0821dcbd2967eae8ad12f6f7ac5710b5ad341e1103749b8912d034bfb126b8d5fd09137eda7b8bb5f8573edf9ac06cf07cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
3c37ab480a8db35fb68016f32ae57682

SHA1
bb3ae3c93a2206ba07f8d70f1b9c7cb4a8a8566f

SHA256
866aa27375ea8e816d4f472d3230972d8cb8d0bf3de95958044eff2c498218a5

SHA512
051972a8b4c93e8f1028a460f8b4531f7dba563f7c76e0114c41ce1b42145cf705da8d5aca62457539ec7cc125f3dbace4e533ce82461a881509fee6f8e8ae8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
cfc83a8c49be10a823adbc043fb206c5

SHA1
5e7b2cd4b6abeaf9471cd7b3143fedc6b6e24657

SHA256
84e3d90beb07df3f7dcb57490ba2836bd48383eda338558d491c07a27fa84904

SHA512
3fe6e808b282d4e60ab92e148b1e631484c9d45b979c690e3b313b462c20464b5e4cbf71b0ad5cef9c11362d9ea920282dfe7211c3641cb900c0625fa9cd618a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit