hxxp://24[.]161[.]98[.]74

Analysis

max time kernel
149s
max time network
146s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
14-01-2024 17:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://24.161.98.74

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133497275064050977"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1936	chrome.exe
1936	chrome.exe
4168	chrome.exe
4168	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe
Token: SeShutdownPrivilege	1936	chrome.exe
Token: SeCreatePagefilePrivilege	1936	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3620	1936	chrome.exe	72
PID 1936 wrote to memory of 3620	1936	chrome.exe	72
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 4832	1936	chrome.exe	75
PID 1936 wrote to memory of 716	1936	chrome.exe	74
PID 1936 wrote to memory of 716	1936	chrome.exe	74
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76
PID 1936 wrote to memory of 4960	1936	chrome.exe	76

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://24.161.98.74
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9933a9758,0x7ff9933a9768,0x7ff9933a9778
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1708 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:8
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2704 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2696 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:1
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4184 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4328 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3188 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3568 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1556 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2428 --field-trial-handle=1692,i,4433274954331176943,17681355209115941898,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5a2af93c481f5c7189d6ff62a2da52cf

SHA1
23fb95301f3e1ef1db76965456b8a81ab9cb619e

SHA256
1a62beaf0bef7bbf65b67a9b1488d626c784dd0d4dd183e5cb7c5acb592fac7b

SHA512
2d2a4d4a9ece51df6e0023db4d3c5c17faf009ff46578ac04c1a88febd74ad381a767d2272b7a2e73edd58a8c3ab160956d54c95310558687b18b459b9bc1d75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d75c2e73dad81d155a9d521d7a2657ea

SHA1
a20677d597d2aed6147d2f5f38c23add0c7b18bf

SHA256
9c34f5a1281243792848a5d2f9967bd4f92d6644130b22efba6677d10d2cf1e5

SHA512
8d0159224450406f86fbf8d684b8bd213a1b56f870a6d1f304fe2d231aa441aa9199ffa1bdb0efe8f7b39b45ef188284cf5569023873bcfad05475756516f3fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1c147e7c0b5fc3f451b2277b9b4126f0

SHA1
1c1d11c5617532e4fa0e93cc9e0b19c67ef76f38

SHA256
b5e45b5b9df2e3b79d22977d5e153b85da120ee8c18fea3dd7283f6e73743554

SHA512
2c079c2bcc2ac57e9694c68430db6cdfe66f92936cb4e1816a22287a88a94da59f99cba6b25ff91662a6e2bc9a3bae0558f6dd646a664766511b3836d45c3b78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
bd6500d8d6519560ab9ea405ccf22f4d

SHA1
c25111b0a2ec8d031efffd2f0a7fd73d876a6ba0

SHA256
191419e9af53261e12963762fd40f89a4e85306a38580d12a5c7adb5401bd977

SHA512
95d55a2f64a5e2ba870b2b9233740e8b53297b5f35c04f4ce40ef45ed2d5da3b549895659ba6492d7ade10b7afdd1acb5607d37506aa32f377fbdfaced6a77f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit