hxxp://click[.]kashflow[.]com/wf/open?upn=u001[.]TUW4V6v08cO-2FnndozLo0x8bSXVbv2Bv8i-2BACPS6kUWl7gsRQjZxOuhbGH1IHeuEcP6n05TITwI5MHqOxOcj6hDJ7A5t-2BnNG-2FHZu4SwA6UHlun1uFPXfV07YgH-2FRXc8QF-2BUQnpgcsaurcjgau1mqBA4RIBQl5nxqITTjUKtGKe1wp14UH1dumbQAPLdmy1AybJVYeQMA0Tfhqlmr0WcHieufFJgWceBL7PMxXHJD-2F7S0-3D

Analysis

max time kernel
133s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2024, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://click.kashflow.com/wf/open?upn=u001.TUW4V6v08cO-2FnndozLo0x8bSXVbv2Bv8i-2BACPS6kUWl7gsRQjZxOuhbGH1IHeuEcP6n05TITwI5MHqOxOcj6hDJ7A5t-2BnNG-2FHZu4SwA6UHlun1uFPXfV07YgH-2FRXc8QF-2BUQnpgcsaurcjgau1mqBA4RIBQl5nxqITTjUKtGKe1wp14UH1dumbQAPLdmy1AybJVYeQMA0Tfhqlmr0WcHieufFJgWceBL7PMxXHJD-2F7S0-3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133579067798074537"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1924	chrome.exe
1924	chrome.exe
1240	chrome.exe
1240	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1924	chrome.exe
1924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2692	1924	chrome.exe	80
PID 1924 wrote to memory of 2692	1924	chrome.exe	80
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 4316	1924	chrome.exe	81
PID 1924 wrote to memory of 3460	1924	chrome.exe	82
PID 1924 wrote to memory of 3460	1924	chrome.exe	82
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83
PID 1924 wrote to memory of 1072	1924	chrome.exe	83

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://click.kashflow.com/wf/open?upn=u001.TUW4V6v08cO-2FnndozLo0x8bSXVbv2Bv8i-2BACPS6kUWl7gsRQjZxOuhbGH1IHeuEcP6n05TITwI5MHqOxOcj6hDJ7A5t-2BnNG-2FHZu4SwA6UHlun1uFPXfV07YgH-2FRXc8QF-2BUQnpgcsaurcjgau1mqBA4RIBQl5nxqITTjUKtGKe1wp14UH1dumbQAPLdmy1AybJVYeQMA0Tfhqlmr0WcHieufFJgWceBL7PMxXHJD-2F7S0-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4dc5ab58,0x7ffb4dc5ab68,0x7ffb4dc5ab78
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1792,i,15333832247159503230,8797383647179084393,131072 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1792,i,15333832247159503230,8797383647179084393,131072 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2156 --field-trial-handle=1792,i,15333832247159503230,8797383647179084393,131072 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1792,i,15333832247159503230,8797383647179084393,131072 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1792,i,15333832247159503230,8797383647179084393,131072 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4160 --field-trial-handle=1792,i,15333832247159503230,8797383647179084393,131072 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1792,i,15333832247159503230,8797383647179084393,131072 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4464 --field-trial-handle=1792,i,15333832247159503230,8797383647179084393,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
76515abeabd3d2961fb1f98767766d8a

SHA1
831e6ef4784a5746ffa9e23b83fa44366923e235

SHA256
bac7077decfb0c0ddf1daba6646ff3849f20a54a60e6137b342ec3aca3f053cf

SHA512
e998e6006530b3e24e8bc9dcce150c09dede9d967397ea1fd95816b80c5d5c784b63f87992f35d3fb2c1dc640c145b25f83a1c074ee3184ca6fc45a2f8ce67b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a09c022a9fb810207db07133e4556fb1

SHA1
423f0cd25f1c19bfdafe8b3722b59c1e72b68d79

SHA256
08d3fd7abada7698561091393aa49e663721a3c1f3dbc035a5121bd4c3d770fa

SHA512
440c3209a9e8653afe71cfa6ee367041a539b97f360ab833c2b76df6fc8e653df2e9599f071f4e23d9a04a6a5f876a55f2c3c853b34cbe55e1e2588baa303ed8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
251KB

MD5
db74f9ddc6d8a843b3073f474447623e

SHA1
0fcad96d57292cb122e5d88fc6cc69cdaf6b581d

SHA256
0084f66fd9ff1474656a66645bca6a091110cbef4f52f6635294a2f947cdafa2

SHA512
10184897a2d671ba769f5de59dcd61ea95697f3d8624f55092948d4eedbd1cc3956b7dde40ba9579e4d0f0c0c95a7b0565bd4dcfcc008b9249d4c2a3ef741887

Download Submit