hxxps://onlinebanking[.]kb4[.]io/XUXpKa3FMOXZDT05sbGZBb09hS2pJK1BoYm5kT1R5S1dsMjVNc2wxU2pEMmFqcHBoRkZYa3dxZHBhWmgwV2NKdnRxSWJCWGVONis3MGw3ZWJXWW5jSnI4aThYeXNMRTZ1NncycnBBaTNnenNTSXdQSkNRPT0tLW90M252MTh2VC9JRkVLcE0tLUhqMG5wQVQ4TFdYN2VBMlBpeWk0RXc9PQ==?cid=244763960

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://onlinebanking.kb4.io/XUXpKa3FMOXZDT05sbGZBb09hS2pJK1BoYm5kT1R5S1dsMjVNc2wxU2pEMmFqcHBoRkZYa3dxZHBhWmgwV2NKdnRxSWJCWGVONis3MGw3ZWJXWW5jSnI4aThYeXNMRTZ1NncycnBBaTNnenNTSXdQSkNRPT0tLW90M252MTh2VC9JRkVLcE0tLUhqMG5wQVQ4TFdYN2VBMlBpeWk0RXc9PQ==?cid=244763960

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31104089"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A81BAAD4-084C-11EF-B9F7-D28C415B03FA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31104089"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2153649258"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421396060"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2093492855"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e15d6e14f38454ea63b5f1bfd9517020000000002000000000010660000000100002000000023d616052c1507cf279502f8bba9b4e15428ffd1550895f9ed51ae8fa1de1696000000000e8000000002000020000000fc4ffc0e45bfc4878e6df0006b45388d8684b6a0c5b8081627ac6759cb8b19f720000000129793de8ccc130d368dbd57c76e8bfc56dc86e4b86a243b5147cbad70ce440b400000001235fcb27d5630bf06c708eafbc94182de346ec93e9c3ba901c283fcb4d35ad4347cfbf76524b50b767797cd8788597a6477ee2434ced7defb45a7a72f179aab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3060c384599cda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8066a484599cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e15d6e14f38454ea63b5f1bfd951702000000000200000000001066000000010000200000008947d205a010498a4ffc207a253a190469c0f2ad946049836e12cfc6d9dbd747000000000e80000000020000200000008fd673085c7f67b07d3b5168dfcd79356015e192da7d35f36870e3a6f3af0e9820000000bf29e7a7322086113199b4cddb2ea7e45d50505b845f628b7e0e18d8c00d97734000000090295946e222c80bf25012306cb430f4452d0e81259cc189b750c35636be00a2b8741c8c01bfcd34bb0289dcd04433645c221a596f2e9e6a0a55c5d4681f4837	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2093492855"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31104089"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133591046754867086"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3580	chrome.exe
3580	chrome.exe
5860	chrome.exe
5860	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3580	chrome.exe
3580	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
4480	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4480	iexplore.exe
4480	iexplore.exe
224	IEXPLORE.EXE
224	IEXPLORE.EXE
224	IEXPLORE.EXE
224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 1456	3580	chrome.exe	92
PID 3580 wrote to memory of 1456	3580	chrome.exe	92
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4284	3580	chrome.exe	94
PID 3580 wrote to memory of 4068	3580	chrome.exe	95
PID 3580 wrote to memory of 4068	3580	chrome.exe	95
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96
PID 3580 wrote to memory of 3816	3580	chrome.exe	96

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://onlinebanking.kb4.io/XUXpKa3FMOXZDT05sbGZBb09hS2pJK1BoYm5kT1R5S1dsMjVNc2wxU2pEMmFqcHBoRkZYa3dxZHBhWmgwV2NKdnRxSWJCWGVONis3MGw3ZWJXWW5jSnI4aThYeXNMRTZ1NncycnBBaTNnenNTSXdQSkNRPT0tLW90M252MTh2VC9JRkVLcE0tLUhqMG5wQVQ4TFdYN2VBMlBpeWk0RXc9PQ==?cid=244763960
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff984f09758,0x7ff984f09768,0x7ff984f09778
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1844,i,13154318876650856025,5471605813864757624,131072 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1844,i,13154318876650856025,5471605813864757624,131072 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1844,i,13154318876650856025,5471605813864757624,131072 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1844,i,13154318876650856025,5471605813864757624,131072 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3156 --field-trial-handle=1844,i,13154318876650856025,5471605813864757624,131072 /prefetch:1
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1844,i,13154318876650856025,5471605813864757624,131072 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1844,i,13154318876650856025,5471605813864757624,131072 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1844,i,13154318876650856025,5471605813864757624,131072 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\XUXpKa3FMOXZDT05sbGZBb09hS2pJK1BoYm5kT1R5S1dsMjVNc2wxU2pEMmFqcHBoRkZYa3dxZHBhWmgwV2NKdnRxSWJCWGVONis3MGw3ZWJXWW5jSnI4aThYeXNMRTZ1NncycnBBaTNnenNTSXdQSkNRPT0tLW90M252MTh2VC9JRkVLcE0tLUhqMG5wQVQ4TFdYN2VBMlBpeWk0RXc9P.gif
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4480
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4480 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2792 --field-trial-handle=1844,i,13154318876650856025,5471605813864757624,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5860

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4928 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:5472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
7dcd658f7257514c95d9237ee57e25f4

SHA1
c762ec9bfb992bd77de5ca6cf5d8f3b605994c31

SHA256
1da58724f00f0235958c6f7d7f78e1ddf7b9ff7592c9cc1e113c50c3948e19e9

SHA512
7eeb5eae72e3831235557054747b117b025c08304ab7c0ecfe7f20cb7a29757bfbcd3f099333ef434808a143cefd36241ec4dd3b605b1b27e800aba119fb3614

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
9a5f301c97b1189e137b40edc9b1d349

SHA1
9bb80c9c6500ea88ec7f905fa1cacc4c993987f1

SHA256
dc509e9161276fb7b23a83df0dfde94dc11a379084c5954517e5573f62a40b39

SHA512
7b99ba7ce8f18ef6e0dd02963521f2c51630a580b678259b1e47474f49b5049756098586439dd040c10979b137e19f52720e5a9e2e29e3545d8b67e861e982a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
561B

MD5
334a9edd417698d6401c41e4208be442

SHA1
6d81c2d28a6f3de38743a9fec13d8543fbe8ec09

SHA256
b0010ccb0dd3f7048fca91f5a2c453de121040613788309671a85dd5000b3a52

SHA512
22cf2f2dff9a722bd26b2976e5d43dc08daaacdcc4661eca9bcb22889899edaae462c192e29ce36e4f41459b56610669ff47dbe2432754889128c74c5b9dd76e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
536B

MD5
025ed7bf1963fce11d59f2caf88f8850

SHA1
7cf1b457179005d6a526d133e531046bf68ff1d4

SHA256
9e7e472d0f9d9662a466c576ea4800a8772228e86a4548f5c3e0ea7bed422930

SHA512
a6bc596c66b4a19d9bc9752b7f0380b65e2c23e47835db1db735d1deb8f33bc723250f74084a445faa270320d3f3b9d7c6590db9ce097099ff9e6ddc840cb302

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
33db7002ff083cffa58b9cc50e23f957

SHA1
9d261448435905035b404b0b777a1a1b866052c0

SHA256
16ea573c79812ae41939b14ad2ec9d4b672349d9a0c26fec21232d92c11060cf

SHA512
f8c548a4257f08bdc152b1ec235014abe8cb1d23d03ab34efef7fb8fbf520d654d8b6d65d8ea5fe5350b83939addf88a19faad59f613c35005d78f663bdf6e52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
48ff1c831b284f5abbe08c0ffdf30fb7

SHA1
f79e09361cfb6f702402055c356f161f0f35ec82

SHA256
d930af9a652ea9816af643b0a682167f13d18bcbf49f359bd22fa62d845292fe

SHA512
82c92023dd260239927f200c83f087fde8c1a48b602ea9e85d6f9c14d556ee50cdcf4a4e083b9ce8966705343aaa8710946766966b9c19abe857c296c92cf6e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9d87303d6cc296248a187ff746fa6951

SHA1
1f2bf03f28ebc1fb43961d5d4222a76d1d0cb0dc

SHA256
7f11ba61dccab7356df94d1f08c0a260b3487b184033ec46ebf8f6a782630446

SHA512
272c625ad863c9f348d819caa12d09c6622febfff1190667b06ebbd12db91c10f24f016e2c9b2f13a794aa552bae047c2e3fb6bcdd6f10e28c3cb325c9ea5ae1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
1471ca21152a86e736e78a2a9b575a7b

SHA1
b9d4a6503ecc746d4908d2576dbebb8588c05685

SHA256
3e795539bd44a48859344652eaad74794dc93f2fadb0ca37917c612d4c3131eb

SHA512
926ebe0fe13a4a554fc102acb50787d4823cac6c9796b7644006007077e34279cc00cf8067572f940052765b99e810c88a0acb2435bba91bf27c0d8c3b97a7d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\Downloads\XUXpKa3FMOXZDT05sbGZBb09hS2pJK1BoYm5kT1R5S1dsMjVNc2wxU2pEMmFqcHBoRkZYa3dxZHBhWmgwV2NKdnRxSWJCWGVONis3MGw3ZWJXWW5jSnI4aThYeXNMRTZ1NncycnBBaTNnenNTSXdQSkNRPT0tLW90M252MTh2VC9JRkVLcE0tLUhqMG5wQVQ4TFdYN2VBMlBpeWk0RXc9P.gif

Filesize
43B

MD5
07fff40b5dd495aca2ac4e1c3fbc60aa

SHA1
e8ac224ba9ee97e87670ed6f3a2f0128b7af9fe4

SHA256
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

SHA512
49b8daf1f5ba868bc8c6b224c787a75025ca36513ef8633d1d8f34e48ee0b578f466fcc104a7bed553404ddc5f9faff3fef5f894b31cd57f32245e550fad656a

Download Submit