hxxp://t[.]co/BU7Tx74W4e

Analysis

max time kernel
108s
max time network
95s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16-04-2024 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://t.co/BU7Tx74W4e

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133577421363308098"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

920 chrome.exe
920 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

920 chrome.exe
920 chrome.exe
920 chrome.exe
920 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 920 wrote to memory of 2896	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 2896	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4752	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4772	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 4772	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe
PID 920 wrote to memory of 3536	920	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://t.co/BU7Tx74W4e
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc54719758,0x7ffc54719768,0x7ffc54719778
2⤵
PID:2896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1916,i,10809203884817644126,6892545475968926733,131072 /prefetch:2
2⤵
PID:4752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1916,i,10809203884817644126,6892545475968926733,131072 /prefetch:8
2⤵
PID:4772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2044 --field-trial-handle=1916,i,10809203884817644126,6892545475968926733,131072 /prefetch:8
2⤵
PID:3536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2836 --field-trial-handle=1916,i,10809203884817644126,6892545475968926733,131072 /prefetch:1
2⤵
PID:3484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1916,i,10809203884817644126,6892545475968926733,131072 /prefetch:1
2⤵
PID:4644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4380 --field-trial-handle=1916,i,10809203884817644126,6892545475968926733,131072 /prefetch:1
2⤵
PID:2732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4400 --field-trial-handle=1916,i,10809203884817644126,6892545475968926733,131072 /prefetch:1
2⤵
PID:4708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4892 --field-trial-handle=1916,i,10809203884817644126,6892545475968926733,131072 /prefetch:8
2⤵
PID:2836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1916,i,10809203884817644126,6892545475968926733,131072 /prefetch:8
2⤵
PID:5056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1916,i,10809203884817644126,6892545475968926733,131072 /prefetch:8
2⤵
PID:3884

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:392

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f0
1⤵
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
d1edeba8693b13e88eb0cc1f0ed9f0f7

SHA1
99f40502f9b54569cd6fe47306550e7aeabda8ca

SHA256
12ee9b47ac61dadd28cd32321a2274b1e645d7fc6f14ccd2419f7ec680decf86

SHA512
fe6fc10e5118054713aba5b5284bf6843e3cbd3ef3c37d7e0c0aae28eebeb04325b1e2038690d9a1e9a498377a9c6f78311529d26815b581361cbad642da91f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0b23f8de-d275-4eb1-a469-7629e3a18715.tmp
Filesize
874B

MD5
81915ff80d84df0c7fc203191d03405d

SHA1
a8a40414145454d00e0cb903c11c5ee6892d3210

SHA256
e95602e868bb11d98371fd438ad80bd83a784fab692106d442c869921b4900f9

SHA512
597b3ba85497f7a3895cfa2345499010aa585aefc2ec5f5055762f3441253ad55508f3a2009c7f5aa08ef754eaca8edb4bf33f0420f3504efef439f44e9c4b6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
26985faa12354faf45b102a6ddced5f8

SHA1
e8ca1b0f9caabbab3dc87b114fb58e7da4facff6

SHA256
2c56c0fd936510a43cadb2a8aab0b1db3d6be85731cedd4fe3ffb597861a5c61

SHA512
9f0f97d96462bf49491d3252b74dcdc20f2a2affa5b31ca7a509879db589237d7184916730f98255b9c6a3a06045d948808aed3f1c2f78e86e9203af79e0216f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f91264a5c44ea6d76559b9e220c56442

SHA1
b03dc5fe8fa7cb6c803c80d4b098e0bd0492df0f

SHA256
53667409c1649b1799d1eb6a823802eccbdff87dc9c0981e946b740294818a0b

SHA512
0e2d55732ba378e2a06e4591adbb3d313e3c8d70f4ff94f1e7e4ac5fa59ba1de0e77b89338b48534af3ac2a61e6e0e80a079d71520e0e928e9c9b47c72cee5e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
6c0e4eac04e29bf932bec529f80acdb7

SHA1
573eb2d3be70f0b74140433448af8201a893f5f2

SHA256
9460db4a562e09b40b4d49c090343d5142d57b7f00b16f0c72047e3fd0bbfe91

SHA512
f7f55b7dfcd69e7db94deee0a720085d725d37945560454da79ca96fec406f2bac71a5d32267d661ab7fec37e7b2ffbcc8d9dd04d10ba695cf354571cff871a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
7a7f2af113fd3d25b20e334a3cdcd1c2

SHA1
236413505f8afa49a7b662af5bc32f2940fe8861

SHA256
cb76efe814d99091956f82b3752abe1932034d8daa66373fd063e0b9f21f4c4d

SHA512
3c2acf59b94b44dc82e27a2d8f0b0cf992295731f6e55572fe510dac7f499d90d435613a9881aa7f89f552f4db3f3af500d561274a79c0c1d9ee3011f59f34fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
f0827871461f4b9fbaeb4044dee212fd

SHA1
065888a851a36e92d80daab255fd94326982a217

SHA256
d3a9e5af8da945d01a6af062d099f4b0995ad89a556d50a639fd5409254b9eef

SHA512
c950aff654926fa07f12f23da151bfd6f738b855c4c8fddc4943da423871858e0c39557fa28bf0c01131054cfc0c394769f3f867f7592877af1e3cd957e5a6bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_920_EZGYJSOKGZQNIPMI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit