hxxps://forms[.]wv3[.]io/form?packetId=5f67e61e-bfbc-4453-8127-c59e52d74618&companyId=763e5a19-bb08-40d1-8300-cdda70732369

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://forms.wv3.io/form?packetId=5f67e61e-bfbc-4453-8127-c59e52d74618&companyId=763e5a19-bb08-40d1-8300-cdda70732369

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133583693300444636"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
3520	chrome.exe
3520	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3492	4564	chrome.exe	86
PID 4564 wrote to memory of 3492	4564	chrome.exe	86
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2504	4564	chrome.exe	87
PID 4564 wrote to memory of 2544	4564	chrome.exe	88
PID 4564 wrote to memory of 2544	4564	chrome.exe	88
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89
PID 4564 wrote to memory of 4428	4564	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://forms.wv3.io/form?packetId=5f67e61e-bfbc-4453-8127-c59e52d74618&companyId=763e5a19-bb08-40d1-8300-cdda70732369
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffd96baab58,0x7ffd96baab68,0x7ffd96baab78
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1908,i,6444493314358476138,15592686526296118789,131072 /prefetch:2
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1908,i,6444493314358476138,15592686526296118789,131072 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,6444493314358476138,15592686526296118789,131072 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1908,i,6444493314358476138,15592686526296118789,131072 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1908,i,6444493314358476138,15592686526296118789,131072 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1908,i,6444493314358476138,15592686526296118789,131072 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4060 --field-trial-handle=1908,i,6444493314358476138,15592686526296118789,131072 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=980 --field-trial-handle=1908,i,6444493314358476138,15592686526296118789,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3520

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
1ac7f75153c29898d812bb25d5e8f617

SHA1
77e511e7ca415ba27010b9c356a039663859755b

SHA256
2df7912ac6e55883d47fdac1f31ad2507c50ff4d652b80fd02dba2d0c153e302

SHA512
85b85072ef09f1ed08ea14e78deca9192933418d30b3f3feb0a13a0ec180c6e43518ba465908a7598bcbc084233072cf6ae82f206a4848f2ab2d2aeb42535747

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
7a0f6266e0a1be87af22f5b6b7e231e5

SHA1
fa430230723095c2ea9ae0257c3fba6b764862ef

SHA256
461b7f1c47e9fd4aaf55e95f757106881e80d6ac86ffd9767f93f73349180d1b

SHA512
5ffa45db4e1e8c1bb412ce3691372a900e78ec1abe9ba102bc1ec784770202cec8da299ab6436c29ce33784fd6b64a15f0fd5a5c2bcc593cf85895dcd050e62e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7f8496eeed1f61b04e022e39a677af55

SHA1
0467db2e6fd2a62cb40a3cfcfbf968a31d0d1255

SHA256
4e78e19f641462ea5d8d60c0e938751806dbbdf0151ec05f795f5cee8a78abdb

SHA512
9aae9550998cba55db015830c81e7590adfdd8b78674375c7f2413c19c766b61f62782e23885dc612bc28f1ee160ff74bb508cbfa66fd7de3884dcb71f5cd3bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
34ffca5b5e4ce6a1a038f0a2743750ca

SHA1
811433b30276428d69c6a48383551015cc135443

SHA256
0e55ab051799abe478b364f930053102672b954290044e846a60945603effd7b

SHA512
5d88b952e8d06343227ae55cdb4d4f0138c64a797b79b92b43aeccb67f95189848ee839a9bc8345f6cb258379f0a6f253f55349375c3a04aee8344b8b160d54f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
250KB

MD5
7575291a965f90560e0af395d14662b7

SHA1
9b1622fa22875e503343a15b849af00bfa5ec437

SHA256
da73fa2729d6a71d6b7555589e4c734a14287e174801e76976b3837796d2b3ca

SHA512
f9df251b6bca9c1776c1a385f76036183fa5d45b048631b6e355e5c15b346353901b16186baa5cfe8485a057e76d1dd2168dad90591cad5c8495578fda98c595

Download Submit