hxxps://pub-a346219fd2a14f599410bf1e0c000331[.]r2[.]dev/brace[.]html#san

General

Target

https://pub-a346219fd2a14f599410bf1e0c000331.r2.dev/brace.html#san

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133578470485440481"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

1896 chrome.exe
1896 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

1896 chrome.exe
1896 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe
Token: SeShutdownPrivilege	1896	chrome.exe
Token: SeCreatePagefilePrivilege	1896	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe
1896	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1896 wrote to memory of 4480	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 4480	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 2440	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 1376	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 1376	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe
PID 1896 wrote to memory of 3848	1896	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pub-a346219fd2a14f599410bf1e0c000331.r2.dev/brace.html#san
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffd77c9758,0x7fffd77c9768,0x7fffd77c9778
2⤵
PID:4480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1892,i,11722144278814324819,7383810037934882914,131072 /prefetch:2
2⤵
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1892,i,11722144278814324819,7383810037934882914,131072 /prefetch:8
2⤵
PID:1376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1892,i,11722144278814324819,7383810037934882914,131072 /prefetch:8
2⤵
PID:3848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1892,i,11722144278814324819,7383810037934882914,131072 /prefetch:1
2⤵
PID:2584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3172 --field-trial-handle=1892,i,11722144278814324819,7383810037934882914,131072 /prefetch:1
2⤵
PID:3860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1892,i,11722144278814324819,7383810037934882914,131072 /prefetch:8
2⤵
PID:940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1892,i,11722144278814324819,7383810037934882914,131072 /prefetch:8
2⤵
PID:1368

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
c478fa5b5bc904d5204e65cddf55b243

SHA1
84bb9b6a227ea7d611cad2b9774776c133876c46

SHA256
f3b0e811b9a919e2392d6584b01fe46765b2b154f8a3b1bfbd1ddbe9f4fc1332

SHA512
8ed96763cc7404e2b4e68c5635006f6bdf97a6932290198d4977168b732f10107e2690bfdb2a0d337c13ee24052dca3ad4376b790cd5d1af58dbf8c0d4e43d24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
986B

MD5
da80ecaf65c1525a2b0a0858b6d7f466

SHA1
6b1cc989d0d980becffde734277353be3444b2ad

SHA256
0380690db92a3cc639d1c5115aeb836d7a38acd3d61c1ded02a12a72502338f2

SHA512
1cc16b1e2115c029a8e9ac3edfd68ab98eae52d34411b5b4383de946a0c265237bcf058558305b5f131c64654ef2478cadd1e6cf5ec44e5aa806a131d0153f3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
535B

MD5
1ddf1593d9a6eff08ae9e775c9b6b53b

SHA1
3b277f32ff13a524c53e1dd04b99d3120a0d440b

SHA256
bd091c3537de4559fb6fef42afa93578da4935e9e5a8a8a918693aa0da309837

SHA512
7579bb8ef6307a21d0bd86409b3775f840a19ab6686b03a4bd083931a21bde4f130cd8c8122a004980b6b104522d5afeaa5966e23a17db197f3b5b51c86a3c69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
622a077cc0c6eaff378a59a2da212b0d

SHA1
2c440d5dd82be6fb42b98437144d7251fa382ed8

SHA256
027b70142cd29073416bf0c1b115919fccd2c35c9e88445e0b436ff4ccd1ec37

SHA512
4598a621a5a761ec2ff39cfdb502fed9160a985f343c9c12b46df40408a38738d07d7dd5da57a6f9f5ba667b8c8168e69af937c0b7d85167ef484ef82ae8aac8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2f089945b9c547a867b46249682207c6

SHA1
18b99ee7dfa9e5b1a1d75c738d0c23bb87531235

SHA256
343891c8072739b32b04ad4132a6eb48776729b4bb210e1dba976b88f604a12b

SHA512
988d32a9c7893953d02f4841db122e8a821546f407b4057d522a98c85cd6e36df05a76d2a0f2ad22a9e97c85fc53a111561127e0f5c8b7f63ad9f95714901f68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
c9e52176cf478a1a37e8089f01540f50

SHA1
336452db3e38f22fecc0f9cc61f19fd0a2d92e30

SHA256
1c5e15963836b3b04239db4f02b585439a75eaed8cb827c5bdd614863f0fd471

SHA512
2c30b55ad46079f8e172645d8bb6fb58ada9a5b605a9a61e88e729ff026b3f33f3268c1b9393d9170111fa45b26e77492088f03b1f9e5c2203c197747347d25f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_1896_SBPUNKKQPDWWCYYM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads