hxxps://cidm-zgph[.]maillist-manage[.]net/click/17e08c77fd19e1c5/17e08c77fd17ab25

Analysis

max time kernel
308s
max time network
312s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cidm-zgph.maillist-manage.net/click/17e08c77fd19e1c5/17e08c77fd17ab25

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133548149349561569"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3056	chrome.exe
3056	chrome.exe
4344	chrome.exe
4344	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3220	3056	chrome.exe	86
PID 3056 wrote to memory of 3220	3056	chrome.exe	86
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4516	3056	chrome.exe	92
PID 3056 wrote to memory of 4004	3056	chrome.exe	93
PID 3056 wrote to memory of 4004	3056	chrome.exe	93
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94
PID 3056 wrote to memory of 1520	3056	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cidm-zgph.maillist-manage.net/click/17e08c77fd19e1c5/17e08c77fd17ab25
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8639c9758,0x7ff8639c9768,0x7ff8639c9778
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1880,i,14629729288856325392,2393130554601091236,131072 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1880,i,14629729288856325392,2393130554601091236,131072 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1880,i,14629729288856325392,2393130554601091236,131072 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1880,i,14629729288856325392,2393130554601091236,131072 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1880,i,14629729288856325392,2393130554601091236,131072 /prefetch:1
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4876 --field-trial-handle=1880,i,14629729288856325392,2393130554601091236,131072 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1880,i,14629729288856325392,2393130554601091236,131072 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 --field-trial-handle=1880,i,14629729288856325392,2393130554601091236,131072 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 --field-trial-handle=1880,i,14629729288856325392,2393130554601091236,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
1c365341ae943b019d53131b145fd4da

SHA1
b18109c461ab47b495f7f2e38108703135c7985b

SHA256
820c9578449d5e66cce6e9fff0e9b8feaaf25eb9ec72fc5f90bf5769ad30e03b

SHA512
6411727b552cae1cb2ed3ce2716e590056736fafcf294ef14654f4d9b2061c8524ec8474160281f8ef66c8670c68bebb55f75b91c9687760069cb2140f24b7a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\109b4e85-9adb-4fb0-974a-7a325e614493.tmp

Filesize
3KB

MD5
3acdfb67c3a868bdb123c36baf9fc311

SHA1
7a94e697b41fd86c3f24007d4f573eabd4940ee1

SHA256
21fbf688bc701bc073f733ca6bcc597081eeb4b180e4b0d18aaf65a8f7eb13f3

SHA512
67adecacb9b87628b631d350b3043c88860def55de924c1b141bb54dbacc2b6e4c7323568588a8ce74deb2dddf48e8e5392b38f86b5f41cf7dc33503515eb624

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
55ecc18980aacd0c9d39e1a6f3428703

SHA1
619c004b146b6b36d0f1f9b0c6d2489d4c89b049

SHA256
4cca2ee047efe6290d98fbb4468260872a3724f3b137cbd903f9b73b1add9f04

SHA512
756adf4910b1503ce2ed98696918ba8f4f0eb671fbbe1fcaed28a05a50e9c80afb9cc767944a20b6e1772e5e1fbce50ca51ece9b8a326b8e31ecfbf1b576fe45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
57bd692653d812d7bd5326c53f3536a9

SHA1
7d5a0ae6b370a4e2aa5b9edfb9fb68cd7f756106

SHA256
9f9127bae145ea283bfad5ef2591b2d24a02c080796e3307230b36b61146c1d0

SHA512
4716c841140eb65807199a26acf0484379e99f652d80056bff80db402f26df0249fdb8923cc7ac63c7366a2efd5a265f6a532c198741e79067a41ee1ccb41a82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
a67afeb2a030e59f96a5e0b848271640

SHA1
c19be4bf0d2c8577d92a04cfb104154448904346

SHA256
239198fd5216d2ac5eead1f42f9aead3e185ac624c12d30d91e5bca32bbce3e0

SHA512
da429c29cb811d86a63131089c0904443bc55cd29a20c425a75a34a6f2ee734506fae8958497a11f726fae0272bcaf62d5af22073bf6c1c7c9715bceffc99d3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit