hxxps://elzincpsiio-e33ec3[.]ingress-haven[.]ewp[.]live/wp-content/m/wlmm

General

Target

https://elzincpsiio-e33ec3.ingress-haven.ewp.live/wp-content/m/wlmm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133499272965295915"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

4304 chrome.exe
4304 chrome.exe
836 chrome.exe
836 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

4304 chrome.exe
4304 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4304 wrote to memory of 3952	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 3952	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1832	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1672	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 1672	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe
PID 4304 wrote to memory of 5044	4304	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://elzincpsiio-e33ec3.ingress-haven.ewp.live/wp-content/m/wlmm
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffedf2d9758,0x7ffedf2d9768,0x7ffedf2d9778
2⤵
PID:3952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1804,i,14881048434940194212,4067932697713170402,131072 /prefetch:2
2⤵
PID:1832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 --field-trial-handle=1804,i,14881048434940194212,4067932697713170402,131072 /prefetch:8
2⤵
PID:5044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1804,i,14881048434940194212,4067932697713170402,131072 /prefetch:8
2⤵
PID:1672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1804,i,14881048434940194212,4067932697713170402,131072 /prefetch:1
2⤵
PID:2408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1804,i,14881048434940194212,4067932697713170402,131072 /prefetch:1
2⤵
PID:3068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 --field-trial-handle=1804,i,14881048434940194212,4067932697713170402,131072 /prefetch:8
2⤵
PID:996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1804,i,14881048434940194212,4067932697713170402,131072 /prefetch:8
2⤵
PID:1408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1804,i,14881048434940194212,4067932697713170402,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:836

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:404

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
c28def4d2714d20535daa05fe8815d67

SHA1
f65bb3c432cde780cd853f25b98ef86c208d2e24

SHA256
e5b8d0f5718e6fa8974a24045ada0132e46097cf016e50f9f9aec1c9db90dbdc

SHA512
448f8e7a3b13e510f9365f2de4a0cfa9996aad81544fe5918856c8ead13b997caaf759f3980da1888ee4508fe8a95de37fc18a50acb49e45e2e3518ff08b4f7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
749b9ba811c57116657c778c39d3960a

SHA1
f3b5dc05a086600bca55f48c97aa888763752249

SHA256
e2510f3150c03c4bbb3053eab74061d05a75745a33cb3f9866cca79170dd50f1

SHA512
dc02fd0fb655b053b3fde2511c6968638aa3e1dcf8688ab889fdff51610125f55feab224c0708a195305f03f138e6624b53ac754ca3f0eb631c9d0f3f2ce7a3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
34b4717ad4b5bd23f9c9046a9348c23b

SHA1
e4e8f98730b45a9d824f6a489fc1c0d12617d9a4

SHA256
0ad6fd73cd5be1b2c6fa38b27eaa9d89fd66d60d105c4ccc103fc0773de8bf16

SHA512
5eedfb6c6450a8f37c5e5e99326b66131f90b62364857b92068cdf6471f23331452559a4c77af34d3b75216162186120cbc79c5304741254483c0e82e5dff14d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
97cf981d31240975827fcad06ad87e3a

SHA1
f1fc7a1581601f1e07636047145159df2c45ed86

SHA256
7d58afa35f0a204b06fe5f01de4dd88f3fa631755f541981bf8fbabf774e06a8

SHA512
77f78af12b9a5fb062392c8347d6085ebcdd5e4933d28c6efe514ec9afbfbbba54667a7cc788e2dd7c57ad006baa86ae4629b7fe2b4b709c15d3e9edddd43998

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
114KB

MD5
6ae439786b176f1fa0f716b3aa48a0ce

SHA1
6fbbace17ad671dc689363f908c66a9a0a61b24f

SHA256
47584cfc681341d2823bfa86ca0024a3b9dd1c6b0674b8552f1e7f5ec6c53509

SHA512
03631c0a713d15dde0034de4854273c33abe39d3c5889baa1723eaa3ea2d42d62f4b9b132bcd87bcec5933aca5c46e0f23129f527377d1610deefd314dacc22f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4304_AHSCDALHZLJOWCRK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads