38a0bbafc75a84c04bbe56270ae10439f124227d93643ebcee8732aabb61be18

General

Target

email-html-2.html
Size

1KB
MD5

a48470abf11448ff56c3ff699425da49
SHA1

0df5acc685d76ba7b699e406e41b56918fc34fbc
SHA256

afd3a945198bc8ba3a77cf2d931bb4b6e8f1aeb4bf8ec74f8ab27bb8ad69c776
SHA512

346fab6ac33efee80c0a49fde181cbb776a0c47d1e4d42c79831d9bcb9d764b372479623f0bd1d6142e4c1eae7edeae5c9ab951679be558500184cece651c3c0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585123229266235"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

3192 chrome.exe
3192 chrome.exe
3148 chrome.exe
3148 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

3192 chrome.exe
3192 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe
Token: SeShutdownPrivilege	3192	chrome.exe
Token: SeCreatePagefilePrivilege	3192	chrome.exe

Suspicious use of FindShellTrayWindow 30 IoCs

Processes:

chrome.exe

pid	process
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe

Suspicious use of SendNotifyMessage 28 IoCs

Processes:

chrome.exe

pid	process
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe
3192	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3192 wrote to memory of 4276	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 4276	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 32	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 4068	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 4068	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe
PID 3192 wrote to memory of 2448	3192	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee7ce9758,0x7ffee7ce9768,0x7ffee7ce9778
2⤵
PID:4276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1900,i,1068748702289874431,12674091558885837892,131072 /prefetch:2
2⤵
PID:32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1900,i,1068748702289874431,12674091558885837892,131072 /prefetch:8
2⤵
PID:4068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1900,i,1068748702289874431,12674091558885837892,131072 /prefetch:8
2⤵
PID:2448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1900,i,1068748702289874431,12674091558885837892,131072 /prefetch:1
2⤵
PID:2096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3304 --field-trial-handle=1900,i,1068748702289874431,12674091558885837892,131072 /prefetch:1
2⤵
PID:2132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 --field-trial-handle=1900,i,1068748702289874431,12674091558885837892,131072 /prefetch:8
2⤵
PID:4536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 --field-trial-handle=1900,i,1068748702289874431,12674091558885837892,131072 /prefetch:8
2⤵
PID:5084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2504 --field-trial-handle=1900,i,1068748702289874431,12674091558885837892,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3148

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:3640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\93289187-cffe-4a4a-a737-fb865517cedb.tmp
Filesize
5KB

MD5
e158bdcaf6d6cabd5809dcf89464b709

SHA1
2ca924269759386b8f02ecbc49ea04c50f681076

SHA256
889b9d3c693155b66214900e3ef3dbf4def1ae57a0650fb56b6266c600d0a904

SHA512
b6b72dd1f0579edc450ec7b6a1f43b37ee512648a0c9aa7c7f024ad1270f8d7b845a3d51dbf5ead7470da232f142df5e5859626957906fbb34eb80cbf1f66cd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
042575ed112031e3374a1e5bb6f2ade2

SHA1
5428550fa532e325f3171b429193fbebba1860e8

SHA256
7b5a2a1bc7d1ff32d0760a360650e0e18e69a15fc134e0895bdba74f882b85ae

SHA512
2ad0e7606690fe0b66c64d240e7d922323e3aae78f0f4824d893a14666a19daa9d9eb1e17a1a22b03f61bdf16d1c0b8f5b3c16eb247797aec76e1715e8cdf116

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
bfac697f58bf39919fdb886bd4a76ec0

SHA1
6b918b3bf4df1f152c1540d992a08b5447b2dc3c

SHA256
bbf9bce2cd11934607f9461bb26d383f269cd63cf81bb0cd374328883ac822c3

SHA512
0b6b9dc3b90ba9353976546c67ae3113e9335b953f40e0b1c5ca8cb6d245cdc63dc18790c320105ef27085f8a20398f5090fc2048d0a17768098243dc8ecfb2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
4c9d00a348ce5abb466ba1579aba7320

SHA1
81b77f725abdeac62a52551dc8c677514c2e0a5d

SHA256
34b5b78de977e38fb71b2a4d17749f08899e2aeb57b06939198d271be5373fef

SHA512
ccd7b35af4345587b78e283c3af53b8bfee3333ea780624116a8d17a690d17d8c57bdd65a2d94c8f82f35860faf576375389283182e16e90b78b1d64525b6af8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_3192_ORBRDMSDVRGDLGAY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads