hxxps://qrqdqd[.]clicks[.]mlsend[.]com/tl/c/eyJ2Ijoie1wiYVwiOjg3MzQ5MCxcImxcIjoxMjA5ODQ0NzA0MTk0MDgyMzMsXCJyXCI6MTIwOTg0NTAxMDk1NDk5MTY1fSIsInMiOiI2OTRlYTVkMmUzZWI2YjU1In0

Analysis

max time kernel
37s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240508-es
resource tags

arch:x64arch:x86image:win10v2004-20240508-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15/05/2024, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://qrqdqd.clicks.mlsend.com/tl/c/eyJ2Ijoie1wiYVwiOjg3MzQ5MCxcImxcIjoxMjA5ODQ0NzA0MTk0MDgyMzMsXCJyXCI6MTIwOTg0NTAxMDk1NDk5MTY1fSIsInMiOiI2OTRlYTVkMmUzZWI2YjU1In0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133602706818026376"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1748	chrome.exe
1748	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2900	1748	chrome.exe	82
PID 1748 wrote to memory of 2900	1748	chrome.exe	82
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 2172	1748	chrome.exe	83
PID 1748 wrote to memory of 412	1748	chrome.exe	84
PID 1748 wrote to memory of 412	1748	chrome.exe	84
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85
PID 1748 wrote to memory of 2736	1748	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://qrqdqd.clicks.mlsend.com/tl/c/eyJ2Ijoie1wiYVwiOjg3MzQ5MCxcImxcIjoxMjA5ODQ0NzA0MTk0MDgyMzMsXCJyXCI6MTIwOTg0NTAxMDk1NDk5MTY1fSIsInMiOiI2OTRlYTVkMmUzZWI2YjU1In0
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff847d6ab58,0x7ff847d6ab68,0x7ff847d6ab78
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1884,i,9256422413529275645,3207491174567104114,131072 /prefetch:2
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1884,i,9256422413529275645,3207491174567104114,131072 /prefetch:8
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1884,i,9256422413529275645,3207491174567104114,131072 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1884,i,9256422413529275645,3207491174567104114,131072 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1884,i,9256422413529275645,3207491174567104114,131072 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4252 --field-trial-handle=1884,i,9256422413529275645,3207491174567104114,131072 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 --field-trial-handle=1884,i,9256422413529275645,3207491174567104114,131072 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1884,i,9256422413529275645,3207491174567104114,131072 /prefetch:8
  2⤵
  PID:4980

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d6df9855a3c238aa8bfe4481697d0f30

SHA1
91534aad4eae1d88e314a20ed31d2585bb4a330e

SHA256
8fa9d30917cf20e9500df939b843d210e36d5cd44bb1ef3ebac09f7831692353

SHA512
4ef53a9409281c0030fbb00e66f59498fcd682e617f7f61de8301bcaee099effc98344a25d9e957026650e78bd1e7a39a698ab79fb3eb075d1260600ccdbec74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
75ee8919793df60944fc8bb59f571985

SHA1
1d89e02039171f94f7fb70d8678c0840c3663992

SHA256
e468b3ed666eaa5251062cf57a133bfa41f09de134ab32f17f15bd43d37d7d0c

SHA512
56d5ad0c94b2e35e953f516f9a6f93d27335cf400fedd69e608e9b9982e3503a7c6188f93f0a7dd7b36f414f5bc0d2d0d07db605f896ef5c80ec1128165ea3b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1024B

MD5
74ee8bfe0a60e3f0a240e4a116d57e9a

SHA1
219c30eb7059242400f5752600e14f52316382fd

SHA256
97c2e567b7da000a02acf02112fdbb393f9d1ff18f1350b76ee476a181a5c0cd

SHA512
9bef39438e278746e9061963fc582036a5117c3372278e69f4721fd302ebce8a583421a731b4bb8010cd8fd009e10f05d029c1e7aaaf482b2c882ba9673b9847

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
02afd37472325d77153e509cee011428

SHA1
3ec5ec13cae03d14d534d28b540ebd103e78fd4c

SHA256
5736b2bd2f6f8462d0dc46ad77fc8a5ea5e9024d3b2062636dff3e9ae17cf6f3

SHA512
b64b6e39d08bfa8905a364713f91e587973395dd38243b1890cc37eec885a949ff4e4d5611c0e24d24cb87f145fc411644601e495b64f8c104729720c364a5c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
30e0644cd46ade81e3bf7a16deb4a8ae

SHA1
e455794bc1e2cfe57bc4635fc6df197313668755

SHA256
68a73ed22e9e15a851e1c94cf972ed0f02e8fd47d15379b4305a59cc94b56246

SHA512
be5aaa3991e223a6693f8abb527739149bb62e767bcdf593896aca46b7b95b621ea08b4385b37373aa66553a7a560872b109ec475b0b83a5da07dcb00dfaf4cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
1e1318b8e577fcc4c1be0b26287612b8

SHA1
37f8c965745874b86a897c1b55dec37eeb977813

SHA256
ec22cf112349a792456180dde5884c1d6411f5af4d0a8a93eb950ee80ce3122d

SHA512
a7044c734f31ba8e9d8cba7d10f8cbc8bda359b25434f77bb48ce61784216d24bda008e4089cbeae3de1a08a68a6ed0f1374c4622737f510ae831c430d572b8d

Download Submit