hxxps://financialcontent[.]zohodesk[.]com/portal/financialcontent/PortalLoginPage[.]do?mode=inviteAndRegister&servicename=ZohoSupport&contact=edbsne59e90ed9bd9a41d3ba818f2533540fdd67cbd47458f749deb5d9cad4fd51ce2&digest=AI-jCrHDlY4Bl0BUxNYASYXeQsVm

Analysis

max time kernel
18s
max time network
127s
platform
windows7_x64
resource
win7-20231215-es
resource tags

arch:x64arch:x86image:win7-20231215-eslocale:es-esos:windows7-x64systemwindows
submitted
04/01/2024, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://financialcontent.zohodesk.com/portal/financialcontent/PortalLoginPage.do?mode=inviteAndRegister&servicename=ZohoSupport&contact=edbsne59e90ed9bd9a41d3ba818f2533540fdd67cbd47458f749deb5d9cad4fd51ce2&digest=AI-jCrHDlY4Bl0BUxNYASYXeQsVm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3028	2276	chrome.exe	28
PID 2276 wrote to memory of 3028	2276	chrome.exe	28
PID 2276 wrote to memory of 3028	2276	chrome.exe	28
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2612	2276	chrome.exe	30
PID 2276 wrote to memory of 2628	2276	chrome.exe	32
PID 2276 wrote to memory of 2628	2276	chrome.exe	32
PID 2276 wrote to memory of 2628	2276	chrome.exe	32
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31
PID 2276 wrote to memory of 2748	2276	chrome.exe	31

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://financialcontent.zohodesk.com/portal/financialcontent/PortalLoginPage.do?mode=inviteAndRegister&servicename=ZohoSupport&contact=edbsne59e90ed9bd9a41d3ba818f2533540fdd67cbd47458f749deb5d9cad4fd51ce2&digest=AI-jCrHDlY4Bl0BUxNYASYXeQsVm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef75b9758,0x7fef75b9768,0x7fef75b9778
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1236,i,11522142242517477803,17422140896420066569,131072 /prefetch:2
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1552 --field-trial-handle=1236,i,11522142242517477803,17422140896420066569,131072 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1236,i,11522142242517477803,17422140896420066569,131072 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2204 --field-trial-handle=1236,i,11522142242517477803,17422140896420066569,131072 /prefetch:1
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2212 --field-trial-handle=1236,i,11522142242517477803,17422140896420066569,131072 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3232 --field-trial-handle=1236,i,11522142242517477803,17422140896420066569,131072 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 --field-trial-handle=1236,i,11522142242517477803,17422140896420066569,131072 /prefetch:8
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3540 --field-trial-handle=1236,i,11522142242517477803,17422140896420066569,131072 /prefetch:8
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1044 --field-trial-handle=1236,i,11522142242517477803,17422140896420066569,131072 /prefetch:1
  2⤵
  PID:1604

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
080c89f7aa8364b001cceed5fb13d7b8

SHA1
7eb924839738039acef2b63e77a406362c41631f

SHA256
06deced47626092edbdc1a4f45f9f5f87b00268c0fa106ad1acd15a426fc8a8b

SHA512
d4490a47132239cc92da1d5eaabd9a1baa97e1da83f906b61727ceda45c4da5087a37a45cecd26962ee39f2b35ad5a767cfce0bcdede87af75fce2fe1646b45d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b99a8a24a9b7e11c551403574ae051e

SHA1
7ae1df30696bd79ff8068e976ff947e6e964d0cc

SHA256
84d5e17d6a3c8cd070ecb4ad0d8c7475116de840ee3c55ea94d3b85ad15ed8b2

SHA512
7d9c8a12dfd8f979e94fd9bc25d2003bd775e648c1c07c45774f2c6707b762a08f425f2748dbaa715308542dbfb6eea62c68b29e057109a1fe1a0996292903f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ec9ae2d849475323f0949efb4fdda9f

SHA1
0a8bd378d4c7326ee81948018279d2cb3bcaceba

SHA256
fdc702619094d90bbce45288aded000679d2b08d88be6bc961b7fb5b583934ac

SHA512
2c57f221fa3cb473d26b75c789a508038520bde58c311a9c10a7597772682781ce348ce60c2c9d22f5b436fdeb29238cae3654652444c67c074881c73314e28a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\564c0218-17ac-48f2-b2de-4b3bd3904f17.tmp

Filesize
6KB

MD5
59ddefd3898ad9f2208fbaffaa9e9795

SHA1
483cf257d06092b4fc4b9e2af5eacda2bb1ac06f

SHA256
8612e6ccc7595e9798d45c452d4087b0b6a71396ba16f945f33010082c35b3f3

SHA512
eb3199d5fe9045625a0a63abeec39c2fadca9fa952ef96c2c97e04a7c79f7c8cec199daac2682d554659407bd8e9b84e87d4f5cac9f44099c3cbb81c6c7d90f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
689B

MD5
a7adaef2ad3e09c1685b1f9b00a8a684

SHA1
047e0979a336e3c9c4095346cc7694a9a1715327

SHA256
1acf4d4bcfc51714d0c5814890ce5ef9b43b0b71bb4176bb5efccaf6d130fadb

SHA512
810563c939d911bdbc68e268d007a80488d7eea80038ab44dd6b8503bd769faf0386345062257b630f4fff7abf9a38a7907d0b5e8675f5ac3c89210c28c2dcb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1017B

MD5
6618de6be28b8f8dcb9048244ff15aee

SHA1
04cf06f9d84349d0d430de2869c4dc10f085da2e

SHA256
029575c006e1f9a82758164211ed32bc154e51642d87e9c32ffc12a80344d120

SHA512
c261358a59aaa54985ad310ed0fca7b858922126fd4fcacc5f70d297ad7f88b9182a277b24f136ef5a837840c366534a1eb23118096b03fa9bb2747007ba8789

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
29b5845a2675e96fce6e1ae98b2bcc52

SHA1
492a5110e50e0003ec6816264648a13759b71551

SHA256
389ee4c7199f08646a4a10eb468a9bc96c56930661946b6160580e904e424ac4

SHA512
b1129274ffa422001341236aa1c1b75a1df277103c80920cd0107f8c65a441ec1fea9ab6ae6edfc2b0feaf0fbaa6ae6a399fa05afb11e54123d11d5bce68fb5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D90.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit