hxxps://t[.]co/NhxL4aClWu

General

Target

https://t.co/NhxL4aClWu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133580145805742737"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3924 chrome.exe
3924 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

3924 chrome.exe
3924 chrome.exe
3924 chrome.exe
3924 chrome.exe
3924 chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3924 wrote to memory of 4192	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 4192	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1672	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 4464	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 4464	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2968	3924	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.co/NhxL4aClWu
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdc0c9ab58,0x7ffdc0c9ab68,0x7ffdc0c9ab78
2⤵
PID:4192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1792,i,1724579698143036051,12169970086886738641,131072 /prefetch:2
2⤵
PID:1672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1792,i,1724579698143036051,12169970086886738641,131072 /prefetch:8
2⤵
PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2112 --field-trial-handle=1792,i,1724579698143036051,12169970086886738641,131072 /prefetch:8
2⤵
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1792,i,1724579698143036051,12169970086886738641,131072 /prefetch:1
2⤵
PID:4676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1792,i,1724579698143036051,12169970086886738641,131072 /prefetch:1
2⤵
PID:4672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4108 --field-trial-handle=1792,i,1724579698143036051,12169970086886738641,131072 /prefetch:1
2⤵
PID:3496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4324 --field-trial-handle=1792,i,1724579698143036051,12169970086886738641,131072 /prefetch:1
2⤵
PID:5112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=1792,i,1724579698143036051,12169970086886738641,131072 /prefetch:8
2⤵
PID:4280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1792,i,1724579698143036051,12169970086886738641,131072 /prefetch:8
2⤵
PID:2356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4668 --field-trial-handle=1792,i,1724579698143036051,12169970086886738641,131072 /prefetch:1
2⤵
PID:3284

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3308

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
689B

MD5
094be713d370d6de4f6898d7206f90fa

SHA1
ddfb77f31ad291b0d6085a498abbcf9acdb77568

SHA256
b3259f73acbdd78fd8fce4fb16070461c5865d4962705fe067a228f3e2eb0f60

SHA512
0f8730b90ca2a797170b6a16e0496bc495fd08d60835fc107db904f2d259a781e766fd1b7623096029ea86c22e3a48c24a5a0372a45dcd91d59376ac112b469d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
bbec6e45506641f5fa70825d7d99e79d

SHA1
e9629f58847927e07c01dc65cfedd1160134d5e1

SHA256
d74a28f0b9d8f9a7061bcf80de8e367ac77522a6e5e4207032701d1c97d7f18d

SHA512
fb3ace6a5c41145178fb2ad9c7b691f00931d62fc6a510db5eaa263e97d8f1c194e62791469e1fdf32d1f0cf06f712d7d631efabcc1b4c0d9949c346a0d84e58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
127KB

MD5
850c7cdbbdc535b9df0a8e1356c680d1

SHA1
7cb099099c329cb1d366f086e0adac4cd9374054

SHA256
70c2b231a0f067198d8d02084ee1227dae02645ab309d2f6b2ff2d6fb0c6632f

SHA512
8e34e31667ab88692cf1cf811b2a869956c1ad2cc72a1a104e32071705e228995e675ef6d54c1b8cc5cd50b629389746ba3a15005392fd4d0e575fbe3ade08d6

Download Submit
\??\pipe\crashpad_3924_DRZVEERWJMPVEWXK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads