hxxps://delta-executor[.]com

Analysis

max time kernel
600s
max time network
485s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://delta-executor.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133533077759896419"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
468	chrome.exe
468	chrome.exe
2464	chrome.exe
2464	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
468	chrome.exe
468	chrome.exe
468	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe
Token: SeShutdownPrivilege	468	chrome.exe
Token: SeCreatePagefilePrivilege	468	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe
468	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 4496	468	chrome.exe	85
PID 468 wrote to memory of 4496	468	chrome.exe	85
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 4160	468	chrome.exe	89
PID 468 wrote to memory of 3808	468	chrome.exe	93
PID 468 wrote to memory of 3808	468	chrome.exe	93
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90
PID 468 wrote to memory of 3248	468	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://delta-executor.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfeff9758,0x7ffdfeff9768,0x7ffdfeff9778
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1888,i,10720003367966317539,4248124119719101969,131072 /prefetch:2
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1888,i,10720003367966317539,4248124119719101969,131072 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1888,i,10720003367966317539,4248124119719101969,131072 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1888,i,10720003367966317539,4248124119719101969,131072 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1888,i,10720003367966317539,4248124119719101969,131072 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4908 --field-trial-handle=1888,i,10720003367966317539,4248124119719101969,131072 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1888,i,10720003367966317539,4248124119719101969,131072 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1888,i,10720003367966317539,4248124119719101969,131072 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2652 --field-trial-handle=1888,i,10720003367966317539,4248124119719101969,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\70a2a903-0453-47ea-bfa5-67a57b10ad6a.tmp

Filesize
6KB

MD5
3c89ee6c8894a1f83b6f7aa5eea2429d

SHA1
c4b3117c933e052bd29e6f0cf28553b3e39b369a

SHA256
2a95f07a9056beb4e80e4c08ab91305738c775a2f61a5fe2126502c6c893018c

SHA512
75fad41415f1e47c81378e2203f315518d4c50a5a5913786cf2d2c8c3c9f755e7a42fda2d2cd9e03ed7d3580e3b021ea7a78c7c2b6835dcd56e84f577299ea65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
00df3641bee276bebacf0e49f0d3b323

SHA1
c39e73758169c57c39d48ed643bd9438d29d7de5

SHA256
1388b328ec3e4b6990e4da0d4c204417487f507074668fd0d70a505c5c9749fb

SHA512
dbe226f56b1d44a56840058c46016f6a91c6ed79b44ee7e9467aac8377596767ffd67c9a143bf3a26463fcd97bca1bdbbc81605f3c5403d96c854e6aea47214e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
3d8e6e0f7018ecce1c8f9f2c4d63cbcf

SHA1
7afeda899eb007bd6124ae31ebeccc4d56496c5f

SHA256
fb2c8262c2f745417af934b317116883ba583728be1ca57ae6d870231e23ee43

SHA512
c8380b0ed30f46aa8bf7344ecb54df83eddcc7b8ff193a2a79eabea8b07b979789b4ae64a0a4e531bb0646ecda1b00503827136066b84e2718b187c36bd30ec6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
867B

MD5
2215349c82cff1df8de07bb171a23479

SHA1
0631c0525eb92b4baa9abca7229b3e576705860c

SHA256
f4870e06220fa16097b839f45a3ca7e31751940ed0f66f3cbbbbbb6715c90501

SHA512
39e6e54c955b22ea63d6ea83da0c001fcc1a9cef08eba15883a119f89771398ec0883f2959919cd3f027ede2d06264797456c2b428208c7c1bdae37673e827ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
a9922caa40615f82f2621f1a83ddd459

SHA1
6bcd7bde65638b3e8c03d938b5eccd3d3b993bdf

SHA256
1446c52114231c511c60e3b1e2cef040ca512803ef4e60cf08604a962f57ebc8

SHA512
2bddc370dfe993de23a2068fe8652dbc4c822a2f6b34e4f5388c6c541c52273d89b055d65ff656e3f79999b07e7c3b245a4523d5e8a1fc5ff209d34b1f91c103

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit