hxxps://mercedes-benz-ccc[.]my[.]site[.]com/OSV/s/OSV?language=en_GB&t=hYyDoJgBNHqtcFoelzOkBOJto1Y%3D&id=a0o7S000008tb4OQAQ

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mercedes-benz-ccc.my.site.com/OSV/s/OSV?language=en_GB&t=hYyDoJgBNHqtcFoelzOkBOJto1Y%3D&id=a0o7S000008tb4OQAQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133492714661547476"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2008	chrome.exe
2008	chrome.exe
2128	chrome.exe
2128	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2008	chrome.exe
2008	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3680	2008	chrome.exe	35
PID 2008 wrote to memory of 3680	2008	chrome.exe	35
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 2076	2008	chrome.exe	90
PID 2008 wrote to memory of 3264	2008	chrome.exe	91
PID 2008 wrote to memory of 3264	2008	chrome.exe	91
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92
PID 2008 wrote to memory of 3036	2008	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mercedes-benz-ccc.my.site.com/OSV/s/OSV?language=en_GB&t=hYyDoJgBNHqtcFoelzOkBOJto1Y%3D&id=a0o7S000008tb4OQAQ
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff859929758,0x7ff859929768,0x7ff859929778
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1836,i,3303520542719592122,7808909103872384234,131072 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1836,i,3303520542719592122,7808909103872384234,131072 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1836,i,3303520542719592122,7808909103872384234,131072 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1836,i,3303520542719592122,7808909103872384234,131072 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1836,i,3303520542719592122,7808909103872384234,131072 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1836,i,3303520542719592122,7808909103872384234,131072 /prefetch:8
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1836,i,3303520542719592122,7808909103872384234,131072 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 --field-trial-handle=1836,i,3303520542719592122,7808909103872384234,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
62e6f2300fd1d48f950f33ff3f09302a

SHA1
81aecf047dc89b1443eee578d4bf4cfb332f3634

SHA256
c529a616e00eefdf4fff7fa3b8f495079ded81d252a7947ff6a18b9a46a40810

SHA512
008a8a540a87f1630a05a2bfa7d18310bff3325432cab146e8abce2d4a4f0ec248c261eaa23852fa4924b4497fda19c95c0061fb6157146e23e1e1f670ba8dbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a9f01c20bd8bb3c304703c162b6db258

SHA1
419165d4d131dba8fba4d0f92d0de41cf9c9404b

SHA256
7571f2bc443c508027bc52680b96996cb692a0d598145f9536a92d0acfcb1086

SHA512
b734660193fb166389e922d8d66437365d22a857b2f794d1a45f9e9e15e9bb100cf259308c0995d6d085c8168ed3574642ceebec80846185e86e936cd594fb68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
85ad4e7eaef52b70dc6b5bcdd38b111c

SHA1
90fdb44d913f8bcc97a6493c2dd00aaa38091fa7

SHA256
537a0c2b11b001ae828de5bebf29672ebc75438fe4c708e95ffafc518fb16e59

SHA512
041f220640d4146a0e65b9ef80de56c985f1d47aca25079051db0b6545c865e495e9f6268fef6729fee924fa575eeeee8e867fff0567b2fe48a599d5e0f577f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
d443862a986b5e44cfa6c029829b2682

SHA1
a811bd4dcc0af17866959bdd7fdb25a97dbf311e

SHA256
efcc91ceac22d3466bb77314d0bf2d200b54131e0b46d2370973f8ccf5b2021e

SHA512
4ad4ee026ecaa4b3a88913ea487bd81f86ab26bbf0ec43647a1bb58b1ffdd3ddf07d408149b8cfb52cbd469f2f85c6d6af76e38bde66b9f99137695a96552dbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e73bb55c1ee0ba17775459334bd5f387

SHA1
3999431be8493df88164cda37c6fd52b8851fdef

SHA256
55b38bb5124823c0384854b52548ca83b821b3becb67af659263467c4b0c92d6

SHA512
4bd4c3b8960ad619a9a3357ef52680dc3526fb7981579b136323384e62651774c53b038709c593ff5dd602442060bb6c1e6deecb8e959c32005247a0ec54a9aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
102be14b3fd3c64e737bf5811dc18b72

SHA1
bca9d76379144854e67b58efbc62ce31b6ccd917

SHA256
92d536a786fa508f85ebdbdc314e55e1a30116c1928a0a08fbba680b5c9a4dbe

SHA512
ab3cba9ee4e3545b2d301e70a78c72116b06da98dcaeeb13660e3e9b14b2ab2cffac0dcc5b7952d02dd47bebc9a1cb2035a772b7abe5d48e73ecd93b49a4ef5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit