hxxps://cutt[.]ly/letkkPXZ

General

Target

https://cutt.ly/letkkPXZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607871621129020"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

2228 chrome.exe
2228 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

2228 chrome.exe
2228 chrome.exe
2228 chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2228 wrote to memory of 4652	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4652	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4972	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4152	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 4152	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe
PID 2228 wrote to memory of 3352	2228	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cutt.ly/letkkPXZ
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe297cab58,0x7ffe297cab68,0x7ffe297cab78
2⤵
PID:4652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1780,i,16078923273367231920,16994591608999813551,131072 /prefetch:2
2⤵
PID:4972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1780,i,16078923273367231920,16994591608999813551,131072 /prefetch:8
2⤵
PID:4152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2100 --field-trial-handle=1780,i,16078923273367231920,16994591608999813551,131072 /prefetch:8
2⤵
PID:3352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1780,i,16078923273367231920,16994591608999813551,131072 /prefetch:1
2⤵
PID:1848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1780,i,16078923273367231920,16994591608999813551,131072 /prefetch:1
2⤵
PID:1624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4224 --field-trial-handle=1780,i,16078923273367231920,16994591608999813551,131072 /prefetch:1
2⤵
PID:2280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1780,i,16078923273367231920,16994591608999813551,131072 /prefetch:8
2⤵
PID:3656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 --field-trial-handle=1780,i,16078923273367231920,16994591608999813551,131072 /prefetch:8
2⤵
PID:5060

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
4ea60f9a3f0245f5bdf168c0a4576b98

SHA1
cc6c6dba2e9883db20e721f2a72942c693aa7e15

SHA256
1ab84f13f5be7fa7fcd85cb43e9628cc8536639d5ffd168b0eda98c803650038

SHA512
9c0bf2f4ce1412e80df562203666a8bde1bca48bb2eae4373dc35c5c1c8a594fc279a435a722af325c46843703fc9bc7d53e0a9099e5e0ec66c09ac92136add8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
299d8e30cdc0f11c2f49d5af78d1dacb

SHA1
11344d4ee9a177a31f3416e8357e4c4aaf73283b

SHA256
a46791f504d17de0ec023348004d3279fca7ce88a7302ef99495f2f583685e9d

SHA512
c8e46d5a27561562c222c344fef48b104e61885394b55207548cf8edb475119fc54e256420d9695d20689028e31ec460761af532eb253885a6802214885187a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
130KB

MD5
8261d4a911d83be4719079a838c2c8a4

SHA1
07fd3c940c6ee60a7340cdd6e2fbd0b0d48234dd

SHA256
5057c5ae182151b2149bf863194bc7aceae9fbf9e1e61ea51fc42fb9b204b358

SHA512
62b7b8c5936b5ed04479b99e95b2c243468125ee53f163c2c5010bf500c1fd426393e401e3b22874599b8e575252267efc3fac44b2361faf7f86c5c0d881d8a1

Download Submit
\??\pipe\crashpad_2228_NXGPBTJWETBQEZSI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads