hxxps://financewealthcpas[.]com/

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
15-01-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://financewealthcpas.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133497624909877720"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
3788	chrome.exe
3788	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 1900	4100	chrome.exe	76
PID 4100 wrote to memory of 1900	4100	chrome.exe	76
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3460	4100	chrome.exe	79
PID 4100 wrote to memory of 3504	4100	chrome.exe	81
PID 4100 wrote to memory of 3504	4100	chrome.exe	81
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80
PID 4100 wrote to memory of 3332	4100	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://financewealthcpas.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9fe9a9758,0x7ff9fe9a9768,0x7ff9fe9a9778
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:2
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3268 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3144 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3976 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3288 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3880 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:8
  2⤵
  PID:112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4036 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2212 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4908 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3176 --field-trial-handle=1832,i,17976159210567270608,12819328113626245321,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
823B

MD5
30a343c3bfd2e040b42f5f77f7328429

SHA1
00434329a6673053882c334edd7d8dc49e714b7d

SHA256
cb7ba88c5efb0c2d86664a6873d4ac287179b1b8f2fd2d7d9f4fd15932bea673

SHA512
ea5c148b66d0c4402eb401ab30d7cfc2abc0cd682263fffca3e35c2052e9a401793235d5db308a0385b30147d4134d2f971d8faabac8f3af1e4e3acf1da7a487

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9896f563799bfbf4905b8e6f62aad238

SHA1
bfa8478f8db2ae9feba78c2706c7be51dc147a6b

SHA256
081ffaa96bab74108feb704359c373ee5bee0b504a19cf06cf569b71129f571e

SHA512
7349e1532642f024b57a0c5cec40b9a4957c260717223631b2f7064187e3104860fc4b7acc302d4fd548545f4ead8c2dcd23cd59718d9f6ac3e598ba736b8858

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f869839305021e955d63f55f2833a08c

SHA1
861dfd78ac6250daf360ea064c88e57f2a194a7d

SHA256
a3e3b835866c1e67c913ab982c989c86b4559942e4450f199488bafb5fb7d68c

SHA512
eb49bc45897042875ccc62713c170b8da829fa811a8324906d4dd1c900f04839e6d6f2c8505cf1b358ce3a4b5749e84a918cd8cbd32e44011686b1c4be7804ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
c695f5afb5bdcdde69e544789ca174e3

SHA1
7b4a55d0b55cf8f0c42b7518cdd3170ac319eb4b

SHA256
ca1c0df940b661408ada97cbe74feaceb4702db20b86a593d391549000d37e1e

SHA512
4dd4037036bd3e5afdb6999a60be585fd80c38063807c556d7144e94777df022fe0d1bd3845a2935f546472ad1b5f816372093dfe52482c664e2fe3cf98f9d49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit