hxxp://gv3x4[.]riandem[.]com

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gv3x4.riandem.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601932550778651"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4444	chrome.exe
4444	chrome.exe
1980	chrome.exe
1980	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 1592	4444	chrome.exe	82
PID 4444 wrote to memory of 1592	4444	chrome.exe	82
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3500	4444	chrome.exe	83
PID 4444 wrote to memory of 3028	4444	chrome.exe	84
PID 4444 wrote to memory of 3028	4444	chrome.exe	84
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85
PID 4444 wrote to memory of 2604	4444	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gv3x4.riandem.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffceff1ab58,0x7ffceff1ab68,0x7ffceff1ab78
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1876,i,13859511654974666378,5577516007398387125,131072 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1876,i,13859511654974666378,5577516007398387125,131072 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,13859511654974666378,5577516007398387125,131072 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1876,i,13859511654974666378,5577516007398387125,131072 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1876,i,13859511654974666378,5577516007398387125,131072 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4128 --field-trial-handle=1876,i,13859511654974666378,5577516007398387125,131072 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 --field-trial-handle=1876,i,13859511654974666378,5577516007398387125,131072 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1876,i,13859511654974666378,5577516007398387125,131072 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1876,i,13859511654974666378,5577516007398387125,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e041ae600debaec643d3a91ce84d8579

SHA1
72f30d8d5e39343aa9ad804ef057b59ef10c4118

SHA256
8823d89900f26502eef0524faacc0f2d4c4c3e6defaf6ea87f05d61f24a5532c

SHA512
332553124d5e05dea9acced175cb2bddac710838b476e27c44d8983a8810da748923eb3820ab65ae104643b093e57f8c5379246626ac5e4d22501877ad18d950

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
59951e42e1f8f27033f15d1b4bce3ebd

SHA1
8de71f347e6fce03218316e40de84c996c455299

SHA256
31d9ad4d8b3d0e1787c5ba83a85cf84fa34ed03616fadbd99e7abaed87546888

SHA512
7e9079f825eea4d2340a81a30e583ba4bdf268ea77b7405e91993e886af3260d9628ac44f9eb9c3e9abe066fbbec80572c7b09fe7e9ee9c4ec45ad7ea1d795c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
8e7e5d3b8f93189b16d066b38f87ceb9

SHA1
dc2bdc7d63a1dbcbf19b382db049ee7c804f1e11

SHA256
f72be012da288d0968e99d0b34ae93b888b2633f4f9302c4e017ca48711291dc

SHA512
9583b2747ec794815d291a82bf7a3b15ccb524806b34376d7c2d704047d203156e42e9b28b0993f92f4300351f166a7b58819caf7ca37c5120b2d08fb0c5015b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
fd1e6de01fb62ab3d9a131dec4740d74

SHA1
c7e0b624cb8f5eb5bb814fbb5db3add42cea9843

SHA256
fd91f77415d281b1e72d0e8435128168d58c0c53b772a9ba337ef13743c44b0f

SHA512
0f1b35e91445b395867b5f3c6c1e8af2ead8609e46d8ec28968a94e323fb88fb05b55c759da9d959d0ae2d4ecd5517a42834f01ba4959e3c25ff4110a22cb9b8

Download Submit