hxxps://tdicinsurance[.]com/

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tdicinsurance.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133505311788446424"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4128	chrome.exe
4128	chrome.exe
1728	chrome.exe
1728	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4128	chrome.exe
4128	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3252	4128	chrome.exe	89
PID 4128 wrote to memory of 3252	4128	chrome.exe	89
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 976	4128	chrome.exe	92
PID 4128 wrote to memory of 1076	4128	chrome.exe	93
PID 4128 wrote to memory of 1076	4128	chrome.exe	93
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94
PID 4128 wrote to memory of 996	4128	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tdicinsurance.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5aa69758,0x7ffb5aa69768,0x7ffb5aa69778
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1856,i,4885848426547465668,8550581535888085151,131072 /prefetch:2
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1856,i,4885848426547465668,8550581535888085151,131072 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1856,i,4885848426547465668,8550581535888085151,131072 /prefetch:8
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2784 --field-trial-handle=1856,i,4885848426547465668,8550581535888085151,131072 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2792 --field-trial-handle=1856,i,4885848426547465668,8550581535888085151,131072 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 --field-trial-handle=1856,i,4885848426547465668,8550581535888085151,131072 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1856,i,4885848426547465668,8550581535888085151,131072 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4612 --field-trial-handle=1856,i,4885848426547465668,8550581535888085151,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
b3c502f26c8e6de81673a694afdfa081

SHA1
5b3aeff85aa3f61d53287702a23b8e5bfdabe6f0

SHA256
31f207f9c435b0c127c41b7a628303de28773310232eabda43e0b300171f2743

SHA512
84d62498f7ef4a6d816a868d551587ab2e5166d8bb4f1f9739a80d2f1a0d95ca68b383de526e27372d2da6a649564c822ca423958cc1f58e558a07c04654d985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
c877d7a65d8f429dfd165d1aeee1fd3f

SHA1
001371747c0df6bee39e5d5101cb1a214571334c

SHA256
e67986702cec7fa2532b855e07b71d4a4d2e73070f51fb7bf083e7e7e2691566

SHA512
4e2d8c2d2732c389816fce851a6027dd5e2fb92cfa007587a86fdd8bccb095d9a0d2f34392d3bc8da914e55466508a58d30d05e70aaf47c6b47186696d811fe7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1f71c76a07fd716180f93f67365a870e

SHA1
98d71098ba204dd592a829c73fb1a1d6df034d1c

SHA256
d2589c94508c184caf259ad284ca28483c068c62f2088d6b97e89296c8909b0f

SHA512
5eefc5a3a966e2eaf7c8e98afeab23de3e9be248b503f3265dcffdac182388462428dc73a2903472005a3a3b5bc75cad4a9c12a4a375ef3bc22b74c8c2c05758

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b07d8d43e8ca41f7a586d1681c3beed8

SHA1
b75a83c8ff3aa71fbb3371b4bbaaa3d0fb7abfa9

SHA256
acd782d5acd64ccb354f27550a2d825d5456e244a05057e19fecbf8feefdaacb

SHA512
7728d89ec979647a59fa24f6c63cb929c3b43c5d43f1e40452c5a973cc03faa543228279b11e39b27c4eb84482d57901f96ea42d2f0952a343a91cf28ef69192

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1d6feade822255538f4a375c1a4a832e

SHA1
7d585a6e1657f759ecc75818232438daec033b96

SHA256
26f71f82de0dc19d60d6627fcfe7ae631d1870014fff8320ab55b846bd0b7509

SHA512
8f63224be726d619d8d9f4db11483314b04314f9640320686533222ca1bfc75d39c6773307bca4bcbe1b0a9551accb4aca8616bb69688750a300a1246dc8d975

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0ebad203f52eaeb54801e1c929b3e64e

SHA1
55214e70c23dd854085fb97769185329b21dc622

SHA256
048de53bd8df6a055ab11bdc76fa97f4f850b4d8fac234c732238dc015ce68d5

SHA512
36c63046b3952cd492fdd929ca91f5fe4c3e5fa10b57211e072ece427d8fc202ab391257198f07ab6a78c7ba6a23a3912e33e0eefc05c19153c284ef10222254

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
182fd41729a24dd6d0515a569ff110a9

SHA1
80ad7fc0dad178094cd15fbef3325d9d43a6d19b

SHA256
1bdb2ea14e28592489a9b898cb7ad3447973a91e4fff306515fee8fa187136ab

SHA512
00b9075c385c8276c3810b86ff372d009e1a2aa0f568a278026cb2661020e2c6cd5c3eec69cc4a15397d14017f921e36ec21fad5a2c838aea7d83a90dbcd6278

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2b7f76fd98bf994a1460552a7af14fa2

SHA1
c5d624fba505ddb9222bdc38051d2b924a537996

SHA256
008480a08a213875d9ceccf16ff65be0e914989af5d2bc90449729f520db05fc

SHA512
776c12c9f21e33d5fbe61a70ad266fe2fc525244db7ec73b87574a7c6aca87ac278921d1684080395fdef62479f13a1c24e4cfaae402a06d7129a7ae9b3730b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
63f13fd526ceb6f9e76557b138694cf2

SHA1
34c3b77de0388da7e8f6e68a9b38b26a6c015139

SHA256
a77bc48a8fade919ba207ecae24bd7d7111252d698f30179c772774431c01788

SHA512
c26a83dcf0d134d41c6198a78ce7b02ab1d28818cee0cb2f44e0edbb114655cf6562eabb418613996c215f53249cfa6077eeee12d31c5dade77224f94c646236

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit