hxxp://noortimer[.]com/T42

Analysis

max time kernel
1800s
max time network
1684s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
26/01/2024, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://noortimer.com/T42

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133507637293931892"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
224	chrome.exe
224	chrome.exe
1500	chrome.exe
1500	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 316	224	chrome.exe	62
PID 224 wrote to memory of 316	224	chrome.exe	62
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 4988	224	chrome.exe	79
PID 224 wrote to memory of 3692	224	chrome.exe	75
PID 224 wrote to memory of 3692	224	chrome.exe	75
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76
PID 224 wrote to memory of 4592	224	chrome.exe	76

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://noortimer.com/T42
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffba0569758,0x7ffba0569768,0x7ffba0569778
  2⤵
  PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1844,i,11225747260509783339,10701963695419721972,131072 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1672 --field-trial-handle=1844,i,11225747260509783339,10701963695419721972,131072 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2652 --field-trial-handle=1844,i,11225747260509783339,10701963695419721972,131072 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2644 --field-trial-handle=1844,i,11225747260509783339,10701963695419721972,131072 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1844,i,11225747260509783339,10701963695419721972,131072 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3632 --field-trial-handle=1844,i,11225747260509783339,10701963695419721972,131072 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4632 --field-trial-handle=1844,i,11225747260509783339,10701963695419721972,131072 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3052 --field-trial-handle=1844,i,11225747260509783339,10701963695419721972,131072 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1844,i,11225747260509783339,10701963695419721972,131072 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 --field-trial-handle=1844,i,11225747260509783339,10701963695419721972,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
946718c476752074546b37c839ea8814

SHA1
9056724daf23d4c51c3fd446a11d65ce7bcb9e90

SHA256
a55e32e7a1771169d53b0f2d49f443b809e06f4ffd83ee5fee0c2f605429ee6c

SHA512
281abc0d3d54a092ecb9da8a42857f8ae193d89a58a83fb1b8171d2e8fb71bf08bc3fe33cf354e31062e4d4d2b74c9f496b80f64ee11ae19647e487916a1a705

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
834215fc42bace87370661fc9ab6f476

SHA1
af601e437ee9556e79dbde1d43edb2901d987c8f

SHA256
36da98e9e49397173d68f7816a4ed56710c8a9321509542a3031fdbd3e333b79

SHA512
84e1d5e5e315548b320533133757a6ee917baeeac6fffe2f78b2fe149e46f25a27a8c3849149ef90ae95ee73c2fa556f6fd9780b0f4d51e389e915c46204412f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a1d82c944621b38c1c8ce50e2720e540

SHA1
a45a46cc80f84d64df7f4c99625d18c12b438900

SHA256
bc06d12f7e210568a8d019be7de5886e741f2c4ab56f6ca8eb74f2bb978b73c3

SHA512
d99e4fad2a81603098c4891895129a94ac6c8d262c8754004d5eba1be44f3a74db7fee6bb01b331d5111ca8ee8bb0d4efb36bb5e6d29fb14b631334d0b27cb1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
11ee40e68556dcaf2b0c58203a3668ec

SHA1
42cff33536b88d94b925ffd3d4d8c8147959553d

SHA256
0ae3feafe85fbe0e544751f0d12c76c5e7c25c20504ead7cb19d6e305106bfde

SHA512
540d88e2a08a9f3197f91e3bd2b6111f2a5ae6d0541db4d402574659fb34ccfa1bf81142ec336db98697ed8c42b27b3c56ed32e7ddb48c9305f71da906b9368a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4d6cd11fdacdf7d03f5d2c77e1056886

SHA1
085d403a044e19ddeca5ee901770de0beca63fe1

SHA256
96f36dc4587f1e2ef0f750d19b51dd17465f59bdedf90acdaf2a283cb6f27249

SHA512
fcaa8f565ee33e0d7a79cb9a21eb4da5482dd038a6102e48004e1f797b801431b09006fe2e15024da41186158ea21cb903f1ac793e2ab76c0a9f3fa0b30308a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
1dfc9301cbc7e28970ac722404aebc06

SHA1
64a23242a5615dfd5afad974a7eb8e7b87fc59db

SHA256
1414b547d2b63dbed293b9e228c5abb6e9a0cd7a5a1c630cd2d245bf8ff54fb3

SHA512
b0a72684d49d5893bf236f114393dd2dd21f50ba72c4c397b25d519b8dae7845934e68abb70fa3e85cd9f16f92c2bb8712020d0a2435ffeb6371ea024c88c6da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit