f8735c433fa46296f7ee9d27e3d9a62b9f1430430e4ace71ca4d7c367ab16821

General

Target

email-html-2.html
Size

10KB
MD5

061e4b3e5aa2845228a83426af05b4d2
SHA1

f01995a1e6d02d14b58b43395235abebdb27e021
SHA256

3634e18a9287e80cf766ba727975cc9ae914eab911a88091f5ef1aefbc966f7b
SHA512

15004024de734576a7d19a96a0e09a497ba0a08def6a2e664629436e397cde1d75f660f6026a2aa014f0f2eb4a0982634b9100130c139c662d10127ccb121df0
SSDEEP

192:Ro+7OwR9w9f0lVXJHrWsRp75s3G9Rpq95+UUJvPJckqmoiVuiSH+kwhU98:m+CwR9w9f0/ZSsRt5s3G9Rpq95zUJWd8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582658620168104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

4504 chrome.exe
4504 chrome.exe
3160 chrome.exe
3160 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

4504 chrome.exe
4504 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4504 wrote to memory of 1604	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 1604	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3580	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 668	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 668	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 3612	4504	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6faeab58,0x7ffc6faeab68,0x7ffc6faeab78
2⤵
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1776,i,10777889331445406971,14104146856737050398,131072 /prefetch:2
2⤵
PID:3580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1776,i,10777889331445406971,14104146856737050398,131072 /prefetch:8
2⤵
PID:668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=1776,i,10777889331445406971,14104146856737050398,131072 /prefetch:8
2⤵
PID:3612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1776,i,10777889331445406971,14104146856737050398,131072 /prefetch:1
2⤵
PID:976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1776,i,10777889331445406971,14104146856737050398,131072 /prefetch:1
2⤵
PID:4564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4380 --field-trial-handle=1776,i,10777889331445406971,14104146856737050398,131072 /prefetch:8
2⤵
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4304 --field-trial-handle=1776,i,10777889331445406971,14104146856737050398,131072 /prefetch:8
2⤵
PID:2460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=740 --field-trial-handle=1776,i,10777889331445406971,14104146856737050398,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3160

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
9389b8f6794c590ad5f23175ee5c3c80

SHA1
4be499c0117c707b186ec77929afc81e933bade8

SHA256
2e62d2e1c603ebf49b5a2f8bfb81d699ed987d348e093e4c3bf828860f000213

SHA512
1ac4b1ad77c09e923bc1d33a17f1365de26d26c3a6a31dbca1c9dc333f0cf544188cfbd382bf77c704303bcf48c8540374d2182845d020a7f135c2938117471f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
126KB

MD5
4fc39d9e98a1a91534bba6bf82c63bd5

SHA1
1e4b91026ca0c4cc92c99eed089f7246c6264b53

SHA256
179ab0adcf0564512e5806b0581d2a5300a7f4faef88036705ffb4f686936d29

SHA512
dd4db2fd3b76e3415a18cc254e92f3e2f37542fc735953a41aab337b47fea69432d58c87f844d74dc8b7b90075efd36883d5322e992d7c0bcd70e1999a76b6dc

Download Submit
\??\pipe\crashpad_4504_QWMJNQSXEUKWSWBW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads