hxxps://www[.]dropbox[.]com/l/AADQ4_L-At7J1Nd1nhAb8OSImKHySEFBDLo/report_abuse

Analysis

max time kernel
40s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/l/AADQ4_L-At7J1Nd1nhAb8OSImKHySEFBDLo/report_abuse

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2536	2264	chrome.exe	28
PID 2264 wrote to memory of 2536	2264	chrome.exe	28
PID 2264 wrote to memory of 2536	2264	chrome.exe	28
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2992	2264	chrome.exe	30
PID 2264 wrote to memory of 2400	2264	chrome.exe	31
PID 2264 wrote to memory of 2400	2264	chrome.exe	31
PID 2264 wrote to memory of 2400	2264	chrome.exe	31
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32
PID 2264 wrote to memory of 2932	2264	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dropbox.com/l/AADQ4_L-At7J1Nd1nhAb8OSImKHySEFBDLo/report_abuse
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7099758,0x7fef7099768,0x7fef7099778
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1216,i,17403533122302178646,3287835929484860320,131072 /prefetch:2
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1216,i,17403533122302178646,3287835929484860320,131072 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1216,i,17403533122302178646,3287835929484860320,131072 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2268 --field-trial-handle=1216,i,17403533122302178646,3287835929484860320,131072 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1216,i,17403533122302178646,3287835929484860320,131072 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2808 --field-trial-handle=1216,i,17403533122302178646,3287835929484860320,131072 /prefetch:2
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 --field-trial-handle=1216,i,17403533122302178646,3287835929484860320,131072 /prefetch:8
  2⤵
  PID:868

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\CURRENT~RFf765419.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
1bd328911e16557f494bcce77303ae31

SHA1
87cd767b33b7b3d0e0d42039b3224d6500311c58

SHA256
d663a65b248dcaf426bc88adf5c8bf43b8ec7307a4bb26d12730c15d24f25126

SHA512
3c5d5b1c5b82196ada1c4c4b7d5aab7823ea44eb89e5ab4a72bf7a555be3c3d3b08a5b5d52530f9e792dcbcfcf29140f8e087408f37035795ce5c62db8c6517a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
0d3aabb43d1289c929a88782294aed57

SHA1
570a44b5ff0568a3f9f6519e8b4bb15f5b682b58

SHA256
e756abdbd93f0a96432ead2aed484ae3b75a1e72d1cfab069514fd6191e23ff5

SHA512
918e607aabe9697e058d3a067ef8bec0e0df176699d78ed59975b227cdb0869f9199a56e500c81eefb72bc6c5bc50bd4cfe430360d06b49cb366831bbf12b7ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
40429dd4f3f34d418e3f0a1ff485d68e

SHA1
c68e8fe68f08405b0b890003e9f0d6e06047676e

SHA256
6ec0c11cdc1d9c5f3a36583cb7de5b63a03687a5719cac8e7b9f7aa8d0e118b8

SHA512
28a8e0a4cc8af0ee440fd424f52e0ce211d79664b90183e0e5d7899fdccbbf0c29c67622fbf205bef5322799fb5e5f96e9908c26ceebde876acb5a2de6e9c152

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
c088d463bfc6451d9b675e67d9256610

SHA1
35266f2288854d83621212b3528f7768e9311b49

SHA256
91a6ec89ddbecd80e7d8a23eaf1d070eec6d244ecdf9bbb4e4f17eb5d17bb8ea

SHA512
2461e051c4e084aaf9ac1b4afc16d63ae7968eea907c483124c8344c5c9da4a45315b8fbece93922a5d1313ca6d93da9d76b5da4f3a760271617fc5b72d3a221

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a6f9f8b1d10b08b318c9ef3860981a34

SHA1
b1316bdcf0209b72d27fb473e9d174d645dfb680

SHA256
9d3170205aea4c45fe05cbfb041071a9ae4ffe4047b1dbf5a3f546e79f223662

SHA512
6464c00d72ad46bfc4b1a28da7b6ca894bbabd31b259c8b3b39b8630bd3506cc2f1189103be7e11748d02d50482fffbefc250636c9a40f8bec5cca8bacc9f7c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
83631471ea8758aa0c2dbfe8b40d59fe

SHA1
371985ad856885d2f00c4932902b761cfa4568cd

SHA256
dad8f9836452dd63e1b61e41accfbf4990fcc4bc89d998c1c3d13f723cb46739

SHA512
747aa2452158c7dc7d97135e7c32337d4172fd3d159b78dbfb29cd2ba64d02b2de89a9e999b1b75770da33e5855f27565d5badd2342ea16f72b908db350ef248

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit