hxxps://go[.]microsoft[.]com/fwlink/p/?linkID=2185272

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go.microsoft.com/fwlink/p/?linkID=2185272

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133603144281681866"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4204	chrome.exe
4204	chrome.exe
2012	chrome.exe
2012	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 2992	4204	chrome.exe	83
PID 4204 wrote to memory of 2992	4204	chrome.exe	83
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 4460	4204	chrome.exe	84
PID 4204 wrote to memory of 3360	4204	chrome.exe	85
PID 4204 wrote to memory of 3360	4204	chrome.exe	85
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86
PID 4204 wrote to memory of 2364	4204	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go.microsoft.com/fwlink/p/?linkID=2185272
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbaef9ab58,0x7ffbaef9ab68,0x7ffbaef9ab78
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4244 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4000 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4588 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2456 --field-trial-handle=1896,i,9666811129418857861,15633799624655357901,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
d48370e6ec0ca3cd2813d41f14874680

SHA1
b4b53119260d7afed68e600a2d9a871e087ed893

SHA256
e2b59b00f758b932861f634f1b94026f775dee6aa05dd4d7fe7ffb0a40e7f900

SHA512
cc306ded0c8aef74849233425c7192f1a3f3d7df24f650672c98dc218e1d7b935067df715b624526125ed251ee7a30a6f44a2f2e9621933955c23f8b0e12f932

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
956cf5cb1486423a38741bc93c548af4

SHA1
a7711a4dae29e6a93255fbaa8535040ce8a2f29c

SHA256
d0f5de803fef68cec1170d5386a930c7dab076b1000181fb4c21bcc6bbc0d2e2

SHA512
adb51156f8582dca4e4b0c9b03f1981ec16684ba2b292044409c76b393451126fdda89ef5e060744855f973297dfd568f686579241aac762ad9a274311d7f1fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9d8dd73e404e3fc76bbbb8ff57d3be70

SHA1
f809c7892e1df9bc11a5ddcae5b02211d788ef9b

SHA256
92397c492ac58eb0e1384d2a833454c7439e897b822d81196b242ea3a852eba6

SHA512
dce3f2a8391641c69b20a5186b786a3601f257c7581b394c765f36af6c43f81524cde1ae9101b24bef5c4cb19e05185c4aaa3305e1405ab664882c7e2d2f61e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a17441ea008258eeb2087423b53b3843

SHA1
30ba224eea0be1b97c15017bc51089f6f7f52a18

SHA256
07921c987554077327ff6217599dd6cfdc28c16fe49620766b7e8a0c51de9a3f

SHA512
8c787a59244cc4fae6593144c377c1e9f843096f093b3de204582420f7bfd3e2f2f40d0fece474a8be42e1f83fde17082fdf01a756ee5db31e528a45b63222be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d7f23a064ad60dc2fdb055f825c01be4

SHA1
44abb4ff3f0c35a006940eee0c22c76b9cea84c8

SHA256
38676d7f00c369045e23a018936b4b742adb4767815af25971aeaaacb71de0f8

SHA512
550f4d1416fe4de0eb390f6087a274f105f761052438affa46ef9a7965207075e42c548baf14482e6c852bf29a8df35b1fc9f31a89e56136d27155c6f0df07b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
230ce2feb5e190e53971541e32edeea2

SHA1
6ba2fe727901834c7b2edff043df86ed5ac9d859

SHA256
194b0a6e2753083c994d2fffcff1b68adf25c6a7a0a8c0f4d9989162b99063b7

SHA512
151487e2d0088ddbe57c11d748f8308c67e38eb399faa0115833fbd7f2564048fd5c7607e4f223f50803963ad01d8eb793d3648f769970a640240e7f9b6fca9e

Download Submit