hxxps://sitemsg[.]blog

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sitemsg.blog

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133546941643336614"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 2184	4100	chrome.exe	89
PID 4100 wrote to memory of 2184	4100	chrome.exe	89
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 400	4100	chrome.exe	91
PID 4100 wrote to memory of 4840	4100	chrome.exe	92
PID 4100 wrote to memory of 4840	4100	chrome.exe	92
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93
PID 4100 wrote to memory of 1456	4100	chrome.exe	93

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sitemsg.blog
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ff869969758,0x7ff869969768,0x7ff869969778
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:2
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4008 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3128 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3164 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4148 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2660 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3772 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2788 --field-trial-handle=1860,i,5188131141009977992,15950804720774693316,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1eb586f0dd2c5c68b1349cc5efff4d53

SHA1
a50c1ddba651eee4ca9fcd04ab58954f229f0ff2

SHA256
61e0f639127d5dfcf83477a37525743dc112a95649b1fc1806ecb52a69af2bc0

SHA512
b728d21e524babe2c006f4bc355934899567061e593d2a142bccde875a45fe3d8949835f46ede91b44d4294d8291dbbee4d4e21074d31c7411b3fb164a5bbe59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
30aa41137b4a97dfe8adf05f6033e3cb

SHA1
9c2545a89a32e2475665983c207bf998385d7884

SHA256
6d1af678c0149d97e0b0cee40e932372285fcc40e166c5ecc68aee02b35d5820

SHA512
9ae8bd3098fedb71dc3c2bd8d8dd151923846d2db49d601fe9501bf0eaddb20c49ab099c0e814d38949b8ee42b2c9c32bea4b917e4b998f391e8ffd3b672d562

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a4eb5a216eced0414b7246b2c7b24d7d

SHA1
be4c6d782141cd5c34868c6480573c6767a946db

SHA256
cc7316662a5369af838ed861cc2795e26ce2b888996134d7dee602499685bbae

SHA512
b27ea33eb2b20e9198b8542b161ca9cfdb740db456ce6319e5fdf1ddf57b7cae78a1f4ea754900a0b224a644558e2ee2e578c244b296d1c246ec4d545b9c2dec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
603ef67cb525fc98cc5c1ee04839fcae

SHA1
562affaa5420549b6df90ead9aef13c46b9f525c

SHA256
24c914e967b20a5b50595a7c42eb5bd3d61958816bcadb8048a3c4af9cbc61bc

SHA512
febc4acb76f756be822f00f23315d07d3c19d7e9771ab6f1b6e3473f2458f07f971073faef9c4759501cfa51a270870ebf5284208383b97922cf2d27b14a7121

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit