hxxp://mail[.]wff36[.]shop

General

Target

http://mail.wff36.shop

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

5080 chrome.exe
5080 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

5080 chrome.exe
5080 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 5080 wrote to memory of 3728	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 3728	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 1168	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 3004	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 3004	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe
PID 5080 wrote to memory of 2980	5080	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mail.wff36.shop
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa236c9758,0x7ffa236c9768,0x7ffa236c9778
2⤵
PID:3728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1876,i,2250310944690735135,16033376782138316161,131072 /prefetch:2
2⤵
PID:1168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1876,i,2250310944690735135,16033376782138316161,131072 /prefetch:8
2⤵
PID:3004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1876,i,2250310944690735135,16033376782138316161,131072 /prefetch:8
2⤵
PID:2980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3160 --field-trial-handle=1876,i,2250310944690735135,16033376782138316161,131072 /prefetch:1
2⤵
PID:3904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1876,i,2250310944690735135,16033376782138316161,131072 /prefetch:1
2⤵
PID:3216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1876,i,2250310944690735135,16033376782138316161,131072 /prefetch:8
2⤵
PID:3616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1876,i,2250310944690735135,16033376782138316161,131072 /prefetch:8
2⤵
PID:1656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 --field-trial-handle=1876,i,2250310944690735135,16033376782138316161,131072 /prefetch:2
2⤵
PID:3764

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3204

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
faec689e8f1ef6b31b5512e4e71b24c0

SHA1
de471af6da77f7f16381d7965ac1b8844d73a76e

SHA256
032420a3e423ebb2b211c7260deb86e80292dd3d5c6db10e7e6f55c71a5f7cb0

SHA512
a8810214d67423a022769f61c72fd28a6dad5ac8b89ab74bd53e4c4521362f1e82635f5898de1ca374e9526dcd0d5f7ecc558ed53d7c21c9835a7361505ddb43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
4d27cf28fdc456b639de57ae20ee2a77

SHA1
ee9a9a0fc0705c9c441687c9f3e7f1cfbea6533b

SHA256
11f0475de0e04a4dbcbd9a298971b883ca7d7941db59b8450ffb6840d665cd41

SHA512
f82211808f9fa34f6d0beec548a09d0ba4df6b685d835bbb631f164781edc6f8d27f578bb096be55b966a6ecd29bdd0f3a0b1ecff3c3a008adf8281199624a45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
703B

MD5
367dc7d350b054fe1e3ab8b0055c3c6d

SHA1
d73afd11b823573930a8689944a6c36566d9e5ec

SHA256
1a06a0089a16d4b1597815c0ee718028ebb0f98cbb92e8d36a8ef47e1866e78f

SHA512
be7031f603a6b53d81981890110912a738b7d2924492b16bd739b64e39118aea65a9cf6760518694e208ed8ea39e20159d6b123acce500ffa232178bbe8eae7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
1550f990cecff4e9db65e9ec20f49264

SHA1
0333c60d804d39bcf1ed132887162d3ab5eaa504

SHA256
d08cab6646792e5cdd73e8679a8a7a635c45cf27250bbce0ec29ae63ecbd5037

SHA512
6488051c23ebe67e61c26a3d1a09ee4d553c59bf14bb01ed48e456ea77e94387c751dd9707fe98e781c2c4558dce62d496d3d154377318862f2bb7a0332b5917

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
0c2076383e89727cb48b7cb90877c3ab

SHA1
6fd56430265ac6992dfc876f2c9dadb856f562b6

SHA256
e5826f5ee9224188c652b7d7b3d3b5467a1c64d8d4cf83bec1c4399555fd73f0

SHA512
ea7705d9025e0da37239dcc5a55efbe433d421dd2ae106bdab487fcd19778a1d2161a6e930b396c83e937659e0155942db37026ea70f13febcec155d8d73098b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
114KB

MD5
c3772a8078ae0cde9ee2c29efc7bd2c2

SHA1
384f2c541874c4e2b7fc3ebc5262b861bb0c89ee

SHA256
0a4ee630738d11be777f05a14278f79cdb21e0622bb19910246ae43ede5fb917

SHA512
f0babb4607fff15d8a7e15d5088f3bef3bc0754a7d9374c5b6677776df16a413d553c0f5c7469110f3705659f526948e5dd89df5ee2a6f58f8c73c33908212d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_5080_PVJIHBKNTWRESCJW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads