hxxp://getlovers[.]online/?s=Pretty_132s&Pictures

General

Target

http://getlovers.online/?s=Pretty_132s&Pictures

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133541988899875591"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

2116 chrome.exe
2116 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

2116 chrome.exe
2116 chrome.exe
2116 chrome.exe
2116 chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2116 wrote to memory of 4712	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 4712	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 2668	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 4532	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 4532	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe
PID 2116 wrote to memory of 3340	2116	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://getlovers.online/?s=Pretty_132s&Pictures
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc45839758,0x7ffc45839768,0x7ffc45839778
2⤵
PID:4712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1872,i,7673539090668412361,15174407527357219318,131072 /prefetch:2
2⤵
PID:2668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1872,i,7673539090668412361,15174407527357219318,131072 /prefetch:8
2⤵
PID:4532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1872,i,7673539090668412361,15174407527357219318,131072 /prefetch:8
2⤵
PID:3340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1872,i,7673539090668412361,15174407527357219318,131072 /prefetch:1
2⤵
PID:836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=1872,i,7673539090668412361,15174407527357219318,131072 /prefetch:1
2⤵
PID:1080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4692 --field-trial-handle=1872,i,7673539090668412361,15174407527357219318,131072 /prefetch:1
2⤵
PID:840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4980 --field-trial-handle=1872,i,7673539090668412361,15174407527357219318,131072 /prefetch:1
2⤵
PID:1016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2932 --field-trial-handle=1872,i,7673539090668412361,15174407527357219318,131072 /prefetch:8
2⤵
PID:3396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1872,i,7673539090668412361,15174407527357219318,131072 /prefetch:8
2⤵
PID:1220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 --field-trial-handle=1872,i,7673539090668412361,15174407527357219318,131072 /prefetch:8
2⤵
PID:2648

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3620

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e0 0x394
1⤵
PID:2256

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Filesize
1002KB

MD5
1e6fd17a2c369b38f8238862c1b8b0b2

SHA1
ad44dfb61ff74274d5a87574f486d20b81203970

SHA256
738af0455f72152a57dd1da7fcf69f227e2f7ed31c718cf3f44c4160da948f5c

SHA512
2e73ad716433fd2c024f2657d12305e0c51527b120bd187f761445b983e844ee775d08e6a22293c62dbd769d175f9432e5f3bf9c9d059adc79df019112432043

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Filesize
897KB

MD5
db22417a41407696abf66a9bc95e474b

SHA1
023e409cc8db9b943f94ee87943c02e2a4c194c7

SHA256
f93f5fd0b670cf421520644fa71fec64c7471a729569d5916970d5957b768607

SHA512
a35d99e93c82e0b925e2bb7138afce054e73d67793176be33944494e643eababfbfac5e6c07ec23a6527e8e237f9b52a7e605ff2ebb9fa8e6f695a5e323367ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Filesize
915KB

MD5
c0e296ee87e71fb4e4fedeeb81b5b8b4

SHA1
665954b42cb5456e2e58531f55c794f139987293

SHA256
91eafc68266cd0c350f34d46554e21064a8d0a6e4929a3db891e336a02ba560f

SHA512
9c7b1b9dabb437cc502fdc6c758e0293f78bf14550edf38339f26e25dd9f5ed14dfaf3594952c828ffd0ef390f56f28c9f8131ea3ff5ee3a6be6e7ac5f5f3d31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
538B

MD5
049866689edce213ca3bc78a3ce1c44e

SHA1
5b378f41ea3380a704aa14016ef2676f2166f4d8

SHA256
5e74201ba921514964a1f7121be57521df513b4f65b5d97950601509388bbb99

SHA512
069a5b5f0c59cd955e1471d01e6d741100597338ce57a762a373cc9424221b9a1fa455ec7e5c489afafa6ef0695287d6513c126db85d72182d8831deabec76b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
cb4dfad97bd88d6a07b78faca911a01f

SHA1
7eda88092587b76a5362bf88bbe93f1e9a3d298b

SHA256
76f9ec5c1e0f1bac4c4f9e61863310dd5d9cdd3d7c5992e3d1431a9edcc3615b

SHA512
f1dc0a4f5a2acd73e497c22fa2ea5919aec925dd991ac77da87650f53fc7d819e4cb5fbdc9b9a297c41ca944fe14423ad74d5927ff3d3cb7331cd890ca075ac1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
2b6d8d494bf22a5e56014a1fda4af3b1

SHA1
6b29e88d44da4dafe97bae8599b8b5165749acdc

SHA256
45ae2104ec70472341c4040855445b81c9b616df8b9ed15247cbbe91c5162406

SHA512
c1fdc78b8f99c69e478bc690783189ab0b91a7a06def19ff0744e30e716a4cab20db5133ee51376cbee5f26c36b8af535f2ebccef837592bc69702160a3f8f8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_2116_UBBIGYKWUPZJAZNR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads