hxxp://weightlossathome[.]co[.]uk/fS2yI/sHiTY2xpbnRvbi5sZXN5a0BsZWRjb3IuY29t

Analysis

max time kernel
74s
max time network
66s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
14/03/2024, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://weightlossathome.co.uk/fS2yI/sHiTY2xpbnRvbi5sZXN5a0BsZWRjb3IuY29t

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133549292877560470"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4504	chrome.exe
4504	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4344	4504	chrome.exe	80
PID 4504 wrote to memory of 4344	4504	chrome.exe	80
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 4716	4504	chrome.exe	82
PID 4504 wrote to memory of 2292	4504	chrome.exe	83
PID 4504 wrote to memory of 2292	4504	chrome.exe	83
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84
PID 4504 wrote to memory of 4824	4504	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://weightlossathome.co.uk/fS2yI/sHiTY2xpbnRvbi5sZXN5a0BsZWRjb3IuY29t
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff918049758,0x7ff918049768,0x7ff918049778
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1816,i,65680902678911358,14241968742864997270,131072 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1816,i,65680902678911358,14241968742864997270,131072 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1816,i,65680902678911358,14241968742864997270,131072 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1816,i,65680902678911358,14241968742864997270,131072 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1816,i,65680902678911358,14241968742864997270,131072 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3864 --field-trial-handle=1816,i,65680902678911358,14241968742864997270,131072 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1816,i,65680902678911358,14241968742864997270,131072 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 --field-trial-handle=1816,i,65680902678911358,14241968742864997270,131072 /prefetch:8
  2⤵
  PID:3764

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

Filesize
198KB

MD5
06d38d9bf028710762491328778f9db6

SHA1
83e1b6cbaad5ca5f6dc63453da324f8df28de193

SHA256
91558d69c027808e375e11c80166dc6ba245fbcfce715c9588decc55b4a33dad

SHA512
b197e5f92add72688396a07246ee9842a3b0de36508aa57f0254531cb109c77d0392e00ea28e006f9fbab1b8fee9b333998946de47ca7526b631e8c810780781

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
57e14703e12d1c2cbffd2ea3d03adf4b

SHA1
cd3735cf9d1a2a59c65965319b983d6085a66cd9

SHA256
f93da31c117e1f1bd7ef38207b2d22c2233fbbce8dcde041626642898d8ccc6d

SHA512
e61fbefe9f22cab58fdd15b88bda1fe70d4a32bdd86b9024716e8cf72d4f03bbf8646b47563f4dbd436cb0e0d0666089da252abdbd84fd384dec698c7286663d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a323d31a685689ae7df459115b7b1036

SHA1
3bb46e80b9b4b73da22a04c6fd5bbd43c7115823

SHA256
f9a13ccd330cd61296a20cae0931c45d70db8d26c1701e25664e4b222dab99e5

SHA512
5c3f630136244e6907d17d91780a857954ebc7102db214bbc0b2b5dd8805dbf395e282c7d01e5a83fd060eb680a10c315f2ae9142d17e9611cea9b9c90703236

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b30240228fb087206533f4542299962b

SHA1
40d64ded74741eede06447369c44b71023eb08bd

SHA256
2b4962e88d6fa49cddd494a457b9fd0e7543eb0b05f513a751ad1ba94635474c

SHA512
8dc7cecd7be349106eb19d11517081e4ef0bd112b4fef4b8f0b85c6c0f37e49a16d45d7c12b4ce4f0e75a8ef488a8e83d066620c2813fcb2b1a843e21017c2a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
710e5143963e08f3374cf34c8a973ffc

SHA1
36a46f17ea33075685e1bab5fecbb98bdc51b194

SHA256
0dddd3fb7b40f5160607c093dbe2bc2e7e1d4e0f341452cc35f1f769d3e761d3

SHA512
4427b8abbd125c05de00bf38a49fdcc8bfb4f99e60f94e9e2c9316578a0f4c4a11e11daa818924caa63067d2a202f54df0632215806eceea9ee9ef68db41db6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
479ad276f0b5866c8f77ff0b3c68accd

SHA1
b45b525081b3971ef2b45cb0181fd9d6a6c2e94c

SHA256
2db714805423358cf38a62d4a3b5e173408dc54def84baaceadb52a10aa2b331

SHA512
3d7fac750af7c3b1d57410811acdc1a7528bbbe6eceb0bbd74e7709bd982a7028d3f8542396ca8b83cc1be33b1395c6d8345bca795d6af0c0abe8ee2e6ac144b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
3d05a087002be4362e9c93d2313b1cd7

SHA1
d979c15fafab7ca92530a1dee736eefb0ef299aa

SHA256
0d5518b81125f7e69ddc826ee176ba60e946490f92a7341b22cba132913f5c9a

SHA512
fbd5fd4e2061c7cd142593aa623907f10f23f9c1b404c19d663f6f573c057c6b213c705313682e9c5318c403c3706d89e868e63bd19ae1f7228d8f77109d424c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit