hxxps://xekudi[.]wordifysites[.]com/ndrive/Payment[.]pdf

General

Target

https://xekudi.wordifysites.com/ndrive/Payment.pdf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133565450574068257"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

4588 chrome.exe
4588 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

4588 chrome.exe
4588 chrome.exe
4588 chrome.exe
4588 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4588 wrote to memory of 4520	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4520	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 4856	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 3120	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 3120	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe
PID 4588 wrote to memory of 1940	4588	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xekudi.wordifysites.com/ndrive/Payment.pdf
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd0cf49758,0x7ffd0cf49768,0x7ffd0cf49778
2⤵
PID:4520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:2
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:8
2⤵
PID:3120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2152 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:8
2⤵
PID:1940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:1
2⤵
PID:3804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:1
2⤵
PID:3320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4472 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:1
2⤵
PID:5076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4696 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:1
2⤵
PID:4192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:8
2⤵
PID:3748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1816,i,18105510802628952243,13811130733932597738,131072 /prefetch:8
2⤵
PID:616

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2428

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
76b9008375d1632d9d12a44272240ae8

SHA1
ce634ef4423b863cfc0321012c9bb60921903911

SHA256
34bed7c86ffa465aea1770a9c889034b5524124ff4b20272b2e19596d6c42eb8

SHA512
25adc4ebdbb743f51ef1233b2f5b6bc73e38d48c1de2f9feac4ea85fbf9ec8c0a4e3063e5dd3366b1bc270ea764e4ac9dd8112687db81a34bd8e36f9f7615e86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
757B

MD5
3efdde194b0f3fe03c25ba781271aca1

SHA1
c6911bd87661a5906bfffbeab5b2be5f977dee9b

SHA256
0bfe2e0249dab6e579fb5bbbc93dc03868a1d92cc9aa2dd19709c091eb6b28cf

SHA512
0162761afb3202f15124137998a01eeedaaba5180f2f6432bb1f98214caf81b04a03bd0c93d50dd3c2fbf6e5e04a6336a9a882361d8763997c772fab642e93ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
a2f283d717cb15e0940a8b842fa6f09d

SHA1
89a03ef70daf6b5a8a5217e121d600a04d84d5c5

SHA256
c197cadbc0abde53accd228ef089aa8632bef3990b128398fba7343f87212817

SHA512
7d288f35392d4872de09063186869c4bb831851f83e39bd06cc6e885e8afea82bdc7e331e64478e56bf824af16b4e0154c8b49bd2c81a5fd2c764454b25f9c23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
130KB

MD5
a97d5e18021b63ea7965338e97994f47

SHA1
55ce52fd55acf19ed8fa385cf7c2513769a5d931

SHA256
d8e856b0118eb9ac294dc428a1d4fec2ae69f03816f164788a85a90be53a79d5

SHA512
cb929d234426f2886d0d8c1021372e2930ae1e7f8010d2b7e58ad2b81120f3a3a83726dad8e5f2411fe61a20f1411a13e3ac38eeb9cf7a0c34a4d68cc264773b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4588_IZEHJDSZPPPOAPUW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads