hxxps://bit[.]ly/3hwckK5

General

Target

https://bit.ly/3hwckK5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608928218009548"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

1996 chrome.exe
1996 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exe

pid process

1996 chrome.exe
1996 chrome.exe
1996 chrome.exe
1996 chrome.exe
1996 chrome.exe
1996 chrome.exe
1996 chrome.exe
1996 chrome.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

chrome.exe

pid	process
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1996 wrote to memory of 2712	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2712	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4256	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4668	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 4668	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe
PID 1996 wrote to memory of 2904	1996	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bit.ly/3hwckK5
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffeab689758,0x7ffeab689768,0x7ffeab689778
2⤵
PID:2712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:2
2⤵
PID:4256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:8
2⤵
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:8
2⤵
PID:2904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2836 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:1
2⤵
PID:2728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2844 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:1
2⤵
PID:3564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4404 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:1
2⤵
PID:3392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3544 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:1
2⤵
PID:3524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4616 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:1
2⤵
PID:3852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:8
2⤵
PID:2296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3544 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:8
2⤵
PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4920 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:1
2⤵
PID:3984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4856 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:1
2⤵
PID:1116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4320 --field-trial-handle=1792,i,7498724553540205590,6193176163266041937,131072 /prefetch:1
2⤵
PID:4580

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4888

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
666B

MD5
f27014c972470d513fea0b9d60960de8

SHA1
38678b59d454f4a01c85604688ceb6b7c381fa4e

SHA256
375efcacca26caee9df4bdd1150a1cdf0b8db033f83603dc9ad8cddc981d00b3

SHA512
2ba45092f3fa55b318ff8f631bccb4b32337d97546060a3808e20036f9d48d962329fe9886633588c6a9e06ac65913360b88299b95fdd5f6ee3373e5463d0c9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
10851b1d982cabeb73239a281adc8b1a

SHA1
f49ea803602df09b4553e24c93e80e24d6b6543e

SHA256
2070f862f6598c889b7502f93e00206cd0b05b37918c228cfea22e31c3787513

SHA512
3e1d7f6054f4a4f0b0080e49e10bb57e3d86b585e49b6e75df8fc476ddc1c3624f5766dceb683ab9375410310e24f2912f2fcbc4e1939c38b5ea0da76f988894

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
435f82e1104d2f31702235c64fba965b

SHA1
85c18d784983b76e97b41b8dc60d5928b09c6ce4

SHA256
722a51b215e1d15e39cd29d925ca1e19417a6703c423adcc3cf265864b15c9a1

SHA512
860091b5e98cc5adc52f31676ece31fd90e57171700d091c6d58417bd018e7f08e837316b30e02e7e633ea3f3dfa5c7e568589afd3b821dbec87cefc4f641418

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_1996_SNDIQIQTPQVWHOFO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads