hxxp://xz[.]ysoft[.]cn

Analysis

max time kernel
49s
max time network
50s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2024, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://xz.ysoft.cn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133541980937237736"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5116	chrome.exe
5116	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 3244	5116	chrome.exe	78
PID 5116 wrote to memory of 3244	5116	chrome.exe	78
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 5004	5116	chrome.exe	80
PID 5116 wrote to memory of 1952	5116	chrome.exe	81
PID 5116 wrote to memory of 1952	5116	chrome.exe	81
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82
PID 5116 wrote to memory of 4276	5116	chrome.exe	82

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://xz.ysoft.cn
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbc9cf9758,0x7ffbc9cf9768,0x7ffbc9cf9778
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1836,i,16500298195798517320,4078456670835560890,131072 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1836,i,16500298195798517320,4078456670835560890,131072 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1836,i,16500298195798517320,4078456670835560890,131072 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2764 --field-trial-handle=1836,i,16500298195798517320,4078456670835560890,131072 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2772 --field-trial-handle=1836,i,16500298195798517320,4078456670835560890,131072 /prefetch:1
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1836,i,16500298195798517320,4078456670835560890,131072 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1836,i,16500298195798517320,4078456670835560890,131072 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4944 --field-trial-handle=1836,i,16500298195798517320,4078456670835560890,131072 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3064 --field-trial-handle=1836,i,16500298195798517320,4078456670835560890,131072 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3748 --field-trial-handle=1836,i,16500298195798517320,4078456670835560890,131072 /prefetch:1
  2⤵
  PID:4824

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
429872ffab74988afa89f96a8207e3ac

SHA1
124f47c67c1b27f5ccb02cba759cc612602f130b

SHA256
6221165626bd42d33c4588174a33dd18c8474c9dae1c8050635645e0ef559763

SHA512
f81892b4130f952417032f2015a033bc0b975336fea9de74fdc02b0d366bb30c9e73dbb652f44b9178e9c2241f7578881d106f996a0ebc3d12f4e70f5115e399

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
eee30efd96a33ddd31a0f88979fb5310

SHA1
87b4e1a9bb0f4f461c241d79f0cd4aca210dde7d

SHA256
b35ad9417a305f449867ec9339070cf629dcb989b7e237a9610a381f8ea8a82e

SHA512
0f0cb3144edcdc0511a1b65da6fa3dab51efc0add8c564fe9123c3b15a56837a4fc2e6106642efca525a88a7a69e4cd50a6d5538c25a4394e8360ec428c20bdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
1f895f548bab19c7a5271c647e52a490

SHA1
866d69fb8e6e25e7293f8b5cf79f7ac0e423a6f6

SHA256
d40f947d53d41064a2a31277f4caf797ad0db7e9e63ba5c47b23aad7cc6ab243

SHA512
07ce3b1850f2dfdafd9554f5bfed7164daba35b1208fad6fe9a1d2030340e788c606497d6861264e67b4fd6cf14787879d628d29b031741cda39eb5cf4a8c39c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit