hxxps://ddec1-0-en-ctp[.]trendmicro[.]com/wis/clicktime/v1/query?url=https%3a%2f%2fxinmengcrafts[.]diytrade[.]com&umid=da22ea3d-0532-41b9-a091-22377159fea4&auth=84247b409afe2128671efe0c5790aaffcd4c1d5f-bf0d5c7f101422fc31130b3ebe9dedefc5d2df7a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fxinmengcrafts.diytrade.com&umid=da22ea3d-0532-41b9-a091-22377159fea4&auth=84247b409afe2128671efe0c5790aaffcd4c1d5f-bf0d5c7f101422fc31130b3ebe9dedefc5d2df7a

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1536	3404	chrome.exe	83
PID 3404 wrote to memory of 1536	3404	chrome.exe	83
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 3720	3404	chrome.exe	84
PID 3404 wrote to memory of 2304	3404	chrome.exe	85
PID 3404 wrote to memory of 2304	3404	chrome.exe	85
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86
PID 3404 wrote to memory of 4516	3404	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fxinmengcrafts.diytrade.com&umid=da22ea3d-0532-41b9-a091-22377159fea4&auth=84247b409afe2128671efe0c5790aaffcd4c1d5f-bf0d5c7f101422fc31130b3ebe9dedefc5d2df7a
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffd7e66ab58,0x7ffd7e66ab68,0x7ffd7e66ab78
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1884,i,10719007137959460734,15088590219972565751,131072 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1884,i,10719007137959460734,15088590219972565751,131072 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2124 --field-trial-handle=1884,i,10719007137959460734,15088590219972565751,131072 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1884,i,10719007137959460734,15088590219972565751,131072 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1884,i,10719007137959460734,15088590219972565751,131072 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4160 --field-trial-handle=1884,i,10719007137959460734,15088590219972565751,131072 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=936 --field-trial-handle=1884,i,10719007137959460734,15088590219972565751,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
d2218a890948105b25c90299f183b5a0

SHA1
4c649fa3f8f6092d7cd9ad56da754633424c3c13

SHA256
998947d7767972fd7efd5b26d37e8463a80e48ef98ebdf4deebae4c9684476b9

SHA512
50bc79c612ea752c6e5e66793f61eac2422f20058884a93503a1c7a8121eac912077b6121884ea5b43f4f96aed558986c41e06204fba9e9ead3c5a9ddf57d1b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
46d02ffa1e92fe983c8fd8f7426b84c4

SHA1
e30581be57d05868ab8a57cb99aac5db855db29b

SHA256
2f0abdaac738508f18c3697255143475996ffc44ef2bbbff806dd6f8735af346

SHA512
11450bea4705670a4784420b07defd31cd7fc059cfdbe0e11f2dcf6d24712ec34f404beb010968869a4f9087cfc919feea5ef906f67803045cacbb6a9af4b082

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
dde1622f9d312e133d97fbbbf1347e2c

SHA1
9d68ac3ed673009060ef3e51e63a79cc326e21ba

SHA256
583330acfcc116018b4c3d90d98fd5427111ab6aa8e3fc83d0cb4fadc93bea18

SHA512
ade57c115d27627b1742bbbe4b792766de9f7ac0424287a30853f15efc7b327cc0de36056e816b479fbd0fb74eb8e5f24c13c2b9206d8f26b88a1ea54322b7d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
521B

MD5
3b93a22c9fe0df1a362ee5d2ac3d3094

SHA1
206711c5e4860be3fa39ee97d6f44d91983cff64

SHA256
27210e72bb1927df187e02b854b471b212bd615414085af75c27abd33dc6fcd1

SHA512
1832ea9a30070e6910293806debeef9d055b0857761ddd4293e83cc8c1548bf256fabde46d4f1d4ab0244e3bbd06260324f6bb3b1d8abcef4f7cc4d80a7cabc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b80bb53d90245ed31dac6f06eb4cc389

SHA1
ea1b675cb56265a95ec8516657b2e4f056294baf

SHA256
d33fc882f5b1ee101af3dc8cbcf8fc47c2529a796f016f135a47c7d08a8a9002

SHA512
9a3ecdd40dd1e62349a60ca68ba07c1b9633b7c3dd67afe73a2a03c47b68362155f97f70e804eecaa4b138717eada6fefeb7e6d56850d4093d027178b28ba26c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
01076955e58cf4425a6cd1cf4b7190b3

SHA1
445b033ba2d534d703fdeb57255adf0c98217d5d

SHA256
c73a5e057ec474c953fd13831a984f93ed8d9acc9af63f41176145feeed9c2be

SHA512
b71720a6fbe2805f7901c73a410bdb72e6e2776b3e964471645e53293b9f26a49177b24615b102ec505c1cb9aacfa0e4d5184f93f2b9443307edf02b5cea16fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
d48e4f6520022c2b2e5bdd3a26b3cfc6

SHA1
ddc1a0727a189a367f8d5ac3a445a2592a87395c

SHA256
de058fead6fb0db0b5dc504902c464df98cb6dc77c93d196fc7bdfc9cc198266

SHA512
22436cb5f163def8a0c52868c6d6d94c0f6f7611d327e5463953337a546ece9d82e8d872c2428ae714f7e89b2a7690dfe6588302581f61b6cc6d4894443ab7a1

Download Submit