hxxp://tinyurl[.]com/cloudflames#ventas@exportperusac[.]com

General

Target

http://tinyurl.com/cloudflames#[email protected]

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 cloudflare-ipfs.com
7 cloudflare-ipfs.com

flow	ioc
1	cloudflare-ipfs.com
7	cloudflare-ipfs.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

2384 chrome.exe
2384 chrome.exe
3452 chrome.exe
3452 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

2384 chrome.exe
2384 chrome.exe
2384 chrome.exe
2384 chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2384 wrote to memory of 3020	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 3020	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1176	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1040	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 1040	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe
PID 2384 wrote to memory of 2392	2384	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tinyurl.com/cloudflames#[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffba8c7ab58,0x7ffba8c7ab68,0x7ffba8c7ab78
2⤵
PID:3020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1772,i,17786811550726256534,1441757395536348922,131072 /prefetch:2
2⤵
PID:1176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1772,i,17786811550726256534,1441757395536348922,131072 /prefetch:8
2⤵
PID:1040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2092 --field-trial-handle=1772,i,17786811550726256534,1441757395536348922,131072 /prefetch:8
2⤵
PID:2392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1772,i,17786811550726256534,1441757395536348922,131072 /prefetch:1
2⤵
PID:1532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1772,i,17786811550726256534,1441757395536348922,131072 /prefetch:1
2⤵
PID:4516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3992 --field-trial-handle=1772,i,17786811550726256534,1441757395536348922,131072 /prefetch:1
2⤵
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4236 --field-trial-handle=1772,i,17786811550726256534,1441757395536348922,131072 /prefetch:1
2⤵
PID:896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1772,i,17786811550726256534,1441757395536348922,131072 /prefetch:8
2⤵
PID:2216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1772,i,17786811550726256534,1441757395536348922,131072 /prefetch:8
2⤵
PID:2560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1472 --field-trial-handle=1772,i,17786811550726256534,1441757395536348922,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3452

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6d174345-0ef0-4867-88a6-43b113825382.tmp

Filesize
130KB

MD5
722a0e884b01334dd1d98a0506dc964c

SHA1
316037f8c9a9918b5d381f242d65d916681531da

SHA256
dc034fd91cf575b39a2b60349ccd31bee47d15b2b32be644f8c2ff8af6fe0d61

SHA512
132ef5c076dbad975a717e03b9bd1487a32e035a9d250c1788de7cbae8245b95dc66cdf838f8c4d19fbae061ca42b45cb21c3e651adc2617ab7cfc34dde41a64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
171dcde85ee6121e38729e83a8bdd324

SHA1
3751315c90f519cb1f55301b8b0634f9cb136e98

SHA256
8fe4630580c071c17a348fddff37352408d7ff362d0c44464a7c0dda58d6afe6

SHA512
8394471d8b716ccce317113aafac645fe5b1144f7c29b71e22cd87ac10a0d25c0a299089b346c74ff4ff4d0f4a63c35fec84e27d8eb61ba4e95bc20c9a302cba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
aa3fdb871d89e67bb846b5c0fe58ff9c

SHA1
769054fef80cf738a2f8565c638bcb7685ad8cc7

SHA256
73553112be9f94f4e7a229f34749412742b4ff4d70998c94f449be74a98520d0

SHA512
11ca260a625d8a299a9892a406b16a30545ec3b229c274633c7d071efe60f027ebac64dea680eff889d6e4e158f79f29cab378fd6bba1ea4fffdf619b01befcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6f3b739ee3293ec1eb716f6f58f3b1a7

SHA1
ba2c68c2669dadc4bac68ce2864f2fb75d06bc7c

SHA256
2873bd3e996962bfa4684ede4ded5cd0184cdcc1a7f0abb38d34e82a63fd61d4

SHA512
50589a4568ee4eeda34a4c13ff6f9a0cc1d1d9b4ccffbae0f555c7ec98cc665dd239d23ef70434a3b5e0ac09b8a96d9a87473e94dca8226ee68566fbb701dfff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\crashpad_2384_BNVJZMGJGBAHJSIS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads