hxxp://www2[.]firmex[.]com/e/15482/ide2324Global-utm-source-email/ppf82y/1091554912/h/LCGtxmKy-W8yTV7ZCP8bb80fbr92KV2K9CzqXwc65ws__;!!D1sDotPi8BGI9gw!k589ozuOTv5xSF4Fw9YMpgJbVA61l1gp5TF44zXrL-Gv4DFtRpAForQ6CvduQ7ExQFUQX1IOe0M8xFzRVc11oA$

General

Target

http://www2.firmex.com/e/15482/ide2324Global-utm-source-email/ppf82y/1091554912/h/LCGtxmKy-W8yTV7ZCP8bb80fbr92KV2K9CzqXwc65ws__;!!D1sDotPi8BGI9gw!k589ozuOTv5xSF4Fw9YMpgJbVA61l1gp5TF44zXrL-Gv4DFtRpAForQ6CvduQ7ExQFUQX1IOe0M8xFzRVc11oA$

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133522416860530844"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

2256 chrome.exe
2256 chrome.exe
444 chrome.exe
444 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

2256 chrome.exe
2256 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2256 wrote to memory of 116	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 116	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 2504	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 3308	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 3308	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe
PID 2256 wrote to memory of 1436	2256	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www2.firmex.com/e/15482/ide2324Global-utm-source-email/ppf82y/1091554912/h/LCGtxmKy-W8yTV7ZCP8bb80fbr92KV2K9CzqXwc65ws__;!!D1sDotPi8BGI9gw!k589ozuOTv5xSF4Fw9YMpgJbVA61l1gp5TF44zXrL-Gv4DFtRpAForQ6CvduQ7ExQFUQX1IOe0M8xFzRVc11oA$
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd81169758,0x7ffd81169768,0x7ffd81169778
2⤵
PID:116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:2
2⤵
PID:2504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:8
2⤵
PID:3308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:8
2⤵
PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2672 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:1
2⤵
PID:4920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2800 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:1
2⤵
PID:4968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:8
2⤵
PID:3348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:8
2⤵
PID:4272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4584 --field-trial-handle=1884,i,8112749406376978734,14416192584666416886,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:444

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1588

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
824B

MD5
d9f041c7fec8f6a081b13a1ba655352c

SHA1
b887900236b7c80b901c9616e3c5f71e06ca65bb

SHA256
a41f28a9f8741c7d59a20877f2e32b95bcdc53a2702bb31cf215ee2d758d9f94

SHA512
14d07ae7505f106457071bccb62e13ec5b402696eb2276d6aa487a523d75932b2c34880b8d4623a09df2aabd7b29a3beee5e152ccf95e3ab6e6940005bc62148

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f65dcffac1122ac0fd85c08185f163c2

SHA1
6b0a92badc3370e5b6134070973e6abd0b5d2934

SHA256
185faf6cd96c4f0214937d9a842cbece539678195473f410aa6a9c569e6176ec

SHA512
b39fd413afc3aa0f577f41a1b961cf3157af065c11ea3444d2952f0edf3cbd35ebea83f3e8d85a8efd04fa497d7f4eab7e813a5e43a1df0e057aba8f48897f08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
114KB

MD5
18618118970d2b56cf6e00e7c7002b71

SHA1
c5b2c265153c73b971ab7839b09801fa47a4b399

SHA256
8d0e684c189a76e39b34d87b90b7e3da663a05955a7eb12b0a1f862461bd8319

SHA512
f0f52438bd659b5167e8570a33e54a2425d3c0926a2b4d45a61c2fd0260ed785accac7822f552dd81dcd701febf4bf2b96a376fcf2e7add311c4ed77dec3cd9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_2256_EPPXOFQOPRXYVSJT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads