hxxps://llav9q76a9[.]hstn[.]me/index1[.]html

General

Target

https://llav9q76a9.hstn.me/index1.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133533589322063731"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

5040 chrome.exe
5040 chrome.exe
652 chrome.exe
652 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

5040 chrome.exe
5040 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 5040 wrote to memory of 2672	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2672	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4168	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2344	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2344	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1752	5040	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://llav9q76a9.hstn.me/index1.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x44,0x88,0xd4,0xb0,0xd8,0x7ff8c84e9758,0x7ff8c84e9768,0x7ff8c84e9778
2⤵
PID:2672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1852,i,9471619251910292031,5509469882238706212,131072 /prefetch:8
2⤵
PID:2344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1852,i,9471619251910292031,5509469882238706212,131072 /prefetch:8
2⤵
PID:1752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1852,i,9471619251910292031,5509469882238706212,131072 /prefetch:2
2⤵
PID:4168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2940 --field-trial-handle=1852,i,9471619251910292031,5509469882238706212,131072 /prefetch:1
2⤵
PID:308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1852,i,9471619251910292031,5509469882238706212,131072 /prefetch:1
2⤵
PID:212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1852,i,9471619251910292031,5509469882238706212,131072 /prefetch:8
2⤵
PID:4400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1852,i,9471619251910292031,5509469882238706212,131072 /prefetch:8
2⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3640 --field-trial-handle=1852,i,9471619251910292031,5509469882238706212,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:652

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:492

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
3cd6226723b72849de0f2acc881abdcc

SHA1
5a54884c16872d18e0cb9490eeb079d148bcb103

SHA256
ea3a7b56948fee66c0ee8b2c8a6e186a5301298325fd5fad50d071a9b48e4058

SHA512
8ecb209a9953a111f65e9dfff88780d27130fe777fb346b7113349689401b040d6c12a9737ffcec0d252bc2dbfb99f6ac24102154d96fd5f12cae98de6bf61fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
943c02862688da28f957e28143fd19d8

SHA1
d41ea8ba397b09ad6439f53dd69e32fdf8471faf

SHA256
89d847a638c4f510bb15201bf7d95495955e3351c9f0935bff40e4d295d98b63

SHA512
933a2ae926dd0eafe27c7ff152de2ed37d0a917022930a5cc6d8454cbd932d8c22cb1b6082bb027735bef18148f59c87e27c6cac9038fbec396ab0ecc985160a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
5780db09f312688bca9161227a9760d7

SHA1
5f7ebb1852d7ef1e41ef6413afa1d56d55e95914

SHA256
6571af71c5833098b2ba657920a6f0788dcde35a7a6b6fca20f256909dfc1365

SHA512
107e9b82db10bc4f7e38c70fc8bd01d30e2f45b385728de642b6492abd7e7532d45bceb51baad7dea92d91a7b2c88b83ef49a8aff4cd8ef5400542d3c7a10902

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
f8ca8be959d48decb439797336c785c3

SHA1
9770f73d7223b614e1163de69df08a83eb150499

SHA256
3ca647877547c4c1b3ef0092cf1d0e0963109fbe3758ed51c827b4ff91df1bf4

SHA512
99ea6da0c6f16b5b8fbbc0d61403d9163d66facba32598e261aeeecd5babb5a1066f9986c5c1a71f7bd2e91242450b95b1d5bf76b19f93f62827d9c97c7e6640

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
da03af102c62eff2da66780ba6d5eca0

SHA1
114f7b8551eb2b106ff30dbe99466616a3412e97

SHA256
893a3ab18bbabac15729aa2cb732f3aeb681eff8e9984451fda8c5b0eea4b82b

SHA512
f295e712d12739d7fee4d199b29859871257ec84967d51d721a797bb36de0c24780c31eda43a3d925d8b94af60939db3ef62540efec1970adb7913af25975f72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
130KB

MD5
256a8f376d460ad3aee96e88886ba445

SHA1
64cc7f942fa6825d2eedc31ef0572ac8f6f33f72

SHA256
9d62ffc8b44a95146301d178be35cde08cfd2fd9510864d2e7a388a7acb82b45

SHA512
8fcc0ca95b24d99d3380be8ccb31f79ecabbd6254a6a33000fbfd07ca3f2ea25ec822ddac289a0f7bea9869c6bdaa155dc98363e0d6bb815d71bb61868874014

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_5040_XWJZWKTWXRYSLIVY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads