hxxp://zendicap[.]com/aurantiaceous/4522408443/caribbean/1705195882/dispace/distent

Analysis

max time kernel
149s
max time network
134s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
14-01-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://zendicap.com/aurantiaceous/4522408443/caribbean/1705195882/dispace/distent

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133496731944246061"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
196	chrome.exe
196	chrome.exe
4552	chrome.exe
4552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe
Token: SeShutdownPrivilege	196	chrome.exe
Token: SeCreatePagefilePrivilege	196	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe
196	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 196 wrote to memory of 2436	196	chrome.exe	74
PID 196 wrote to memory of 2436	196	chrome.exe	74
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 1500	196	chrome.exe	77
PID 196 wrote to memory of 4512	196	chrome.exe	76
PID 196 wrote to memory of 4512	196	chrome.exe	76
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80
PID 196 wrote to memory of 3540	196	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://zendicap.com/aurantiaceous/4522408443/caribbean/1705195882/dispace/distent
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb60759758,0x7ffb60759768,0x7ffb60759778
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:2
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2680 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2672 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4224 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5116 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3124 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5064 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3904 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=952 --field-trial-handle=1860,i,9554249121118960082,9631622940306168989,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9cf34981514080547d9d9208ca095c16

SHA1
ba286caa1485d08f955e7b896408a75895e71073

SHA256
23f09b804f4cc1dea9833a415a29024eada94d381457702fe1e0b934cfb986a9

SHA512
3087311a21ef0a197d7f4e82d519ea96eec678c1dfeb9536d282f2480475f99ba2ffb732f7e8f33f057d6541d11cfca7b2a88d77c7f5e1d380646cb6d97dce54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
6185374ac7b38618428c2ad4a163422b

SHA1
a131feaca5360fb3d5632535a5b5663935e0cb9d

SHA256
be406969f283ea800ac29be0db689be81a770a80a54571d91ba6c02d6ad469d9

SHA512
915a4241e0b42c7422f9744ea8c46f71ce9b2fdca2c6cafbd9491a52e10aecc2bef1d084bd053c2b8a63ce8848e3a39d848f4bc46f6cbd97be61ac6e82573792

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fb915b99-b018-47c9-986a-0d2c97f96b27.tmp

Filesize
5KB

MD5
07e7e71cf76968f2acc9fd86586cc298

SHA1
7dd212563bb83cc72e13746868b803aef60900d3

SHA256
5fe1b0936cf4a016c379756613248d0907f3642ad655121345ea146cd3a2752e

SHA512
1a8bea4444d1f237e2ce821d461eeda225fdf29f5321d5fd2c1e964a111421e061338ff8fe099032c3939d98a3ea01aa02f3440ab4a4a9f5c309ad440189bf57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
41ac9655c18c4d07aa77df7436cd296b

SHA1
63d36e7e3bf165149cf36192b9783785d5aaf25d

SHA256
382fc08f8f6ff2fab0a2cdda04ed3050f28050b57c2944aee451d454f87f4124

SHA512
2608fbf7f18fb6645d1d5d2c70b5e819fe8446a86eb02ec5fa8c0ab6bf78110162c40b02c86f4e8291230a47a8588fe9b2d3f20519d04d944be4efb1b2725f79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit