hxxps://vakilpezeshkrastin[.]com

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://vakilpezeshkrastin.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133560080234335761"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
2872	chrome.exe
2872	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 3564	4360	chrome.exe	84
PID 4360 wrote to memory of 3564	4360	chrome.exe	84
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 444	4360	chrome.exe	90
PID 4360 wrote to memory of 4424	4360	chrome.exe	91
PID 4360 wrote to memory of 4424	4360	chrome.exe	91
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92
PID 4360 wrote to memory of 4944	4360	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vakilpezeshkrastin.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe5bb9758,0x7fffe5bb9768,0x7fffe5bb9778
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:2
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3188 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4776 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3460 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3984 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5112 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3504 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3512 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4964 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 --field-trial-handle=1872,i,5268011027595669144,3027864338573809097,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
cfbe5298a8214be93170742bdc32e4e6

SHA1
7fc7bff4cb71898732299ddc141826fd4c9c9f86

SHA256
368255a4632a94ed0a9089cc373136c4ecf5561f776c1e32cf7624cd2804fe96

SHA512
cf58a01cd0e1e837c893bd3af3ca32c048e9de88537b3e283413a2df55af1cf791fe5f33390ebca4795902cb2a53463b593ab256eca6d1df36fb25be5fa7beb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
537B

MD5
ed6204714366c4cb50a9472307fa36ae

SHA1
2f8e7cf7562287904ebead6e801e848f4e95fe67

SHA256
cba3f008e7cb64bf8ce44bab75f7c045af9f9c4d3edebbbac418d4a16377c953

SHA512
0750a0569c93b251cd3f8e59187221ebc43e5d8dd9ad4595093a6f0db8b5e7656c6cec5875338d4bc26f77ccf2e687fef18ed5d11f0d5529e5b1d5f9d21b10e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f48a3c2ddc4b3d2b7b5f2c55089682c2

SHA1
149de8e6a8f47d3a5a8ca6cd37f8ab184fc5a7d2

SHA256
dfc4fa1287183782eba422b35d390f6a69778b4d74c2f39b85719d136bb1e830

SHA512
073d38d7422b619babc1a4707ada864dfc591425ff2cf587e11f96968d06d12e0f34a3f18826fb231ad158d3547aa1defe45cc34c46a29749712c08bbfc379f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5f75490907704c3cc98ea0cad0cf729d

SHA1
8de85dc54f041a92e258590065dee8a8dfe6eb84

SHA256
abff361150a1f652c1276a18eaa6d9d3ea6c2bc05ec67302a48189abdce86022

SHA512
746fa87ac85f01d7ed8d23343c93ccd4cd696b3ac1b8735a00a61321b599b15e99839da96eda590847fba342903d9f942140b54c0019667360ab82c8891fae29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
74efe62f87f5dea2c647ca2e8e0e847c

SHA1
fb01319435f7a914a825504cc77833a833311ba0

SHA256
5df94a29f5b27a55e65529d5feae5226b221cfc8b040f689f36883d3b9d589e4

SHA512
aee5b7915097382e331f2e5b180cd6141049d9261b9373e0d6428a1072e1415b14fc568481c00ee6032ddf5550f5ec9598ef17acb13a49ee6734a570139d50f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit