hxxps://api[.]docweb[.]econfigure[.]abb[.]com/api/Globalpropagate

Analysis

max time kernel
169s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://api.docweb.econfigure.abb.com/api/Globalpropagate

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133579536668353810"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe
3620	chrome.exe
3620	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4528	2964	chrome.exe	92
PID 2964 wrote to memory of 4528	2964	chrome.exe	92
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 508	2964	chrome.exe	93
PID 2964 wrote to memory of 1144	2964	chrome.exe	94
PID 2964 wrote to memory of 1144	2964	chrome.exe	94
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95
PID 2964 wrote to memory of 4928	2964	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://api.docweb.econfigure.abb.com/api/Globalpropagate
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce09eab58,0x7ffce09eab68,0x7ffce09eab78
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:2
  2⤵
  PID:508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4216 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4472 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4356 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4900 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=736 --field-trial-handle=1908,i,5359373081266083267,16788509129231687173,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b7e5822e34922d0560100d6b4a56dff7

SHA1
a0716f5030ffd09ecae69fea901a2b481f6651d2

SHA256
292150fdbed55fefc4ed40689f366c5c61abbcf930579576f7702b38d4395fa0

SHA512
fae93433c503a7d61eb9ca80ce30ddafd287c69d71e67452212165134b4fe5f176fb699c05e307facf092a1784dd45e22030f8a9399f2b1f458c5757431b0095

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
d8b39bd33287fcfcfab9c213a87a40de

SHA1
a5dd87c35d8d0e9e21fd8a3aa81bf157541ef78a

SHA256
f58ffbabee30c303de7e5a833c4bfdb973c2f6d995d2162a6f8d59cccde1ff91

SHA512
cd710cb4d91cbcf96e15a0413cd7b6b6e419f5e809fbc8dbe272c28f63d6b24b643231a3ec0f907e2fc8084cb82e6f8cfc1454c7102e79e532de48440958d533

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
313f56cfeca638c79d288714844ba897

SHA1
4a97eb301caf000d08a3abc955b92224bd093e63

SHA256
f1526f85e5e2a17dfd5713cb0d6596047887543f3e4346fa44d17746b5e19b96

SHA512
7c0902e256aa0f43f741a3b4973d481d376ccc7a2f6e91eaefb99b7b6a0030f144ad7fb95950fe220fceb92bc84297321d35a5402c33d3dc251aa56a0e60c732

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c323a52c7a22aa36bb1572bf6753c7bf

SHA1
7b27b3cc858e870ca3f65193965967cc6c1722af

SHA256
02b8b42c8577cb8755977b51e10228b4e7e6e71cb7bb2ace87a8f562f9193103

SHA512
32d88c2f16fd73530a236a4f1a38933d9804fd856be2c215e9d3ffd5b442cc8b9091e7732abbb6286f98b9fc0781689b0add08e8971f06be0975f037eab225a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2f3d5698e2848d371d3317792b81b455

SHA1
952ef1d19bc4d03a17ca4368736fda44cdb17d6f

SHA256
93c1b5c81420c0c45fc0ee1f4e5571526df3380b2faa01df27b53d82009d07c3

SHA512
d317e14ecd611606f5cd5c75f6f5d99944f1a0ae4cffd58bde19821d0c96983f0cdfa34aaec2741dbccfe47226aa108387c34d9dd567c6cf3998ff3b5bb66c0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
250KB

MD5
89de2787c7c28f2c0d77e4062f31e1e2

SHA1
391ceea6aa38a051cf0775b4adbbad184ee1417e

SHA256
e13818f92001ec51fd8af1260ad664f706c8e4b214184631b6b425810bc71d0c

SHA512
44088cb2fa4797364884e991ee13ddcbe3312b20864eb62775c15a1fae771a43d97e1c212b66371926a9e991826a7285a800c173222337100e129f096c1739df

Download Submit