hxxps://uruhbfhjhsfdh[.]pages[.]dev#?email=d2lsbC5pLmFtYnJvQGdtYWlsLmNvbQ== /1/0101018fa1781184-b2b56582-f4f3-433a-bec1-5584007ab178-000000/KA-4jDVMRvKzqMcc4wmbdISmVB4=376

General

Target

https://uruhbfhjhsfdh.pages.dev#?email=d2lsbC5pLmFtYnJvQGdtYWlsLmNvbQ== /1/0101018fa1781184-b2b56582-f4f3-433a-bec1-5584007ab178-000000/KA-4jDVMRvKzqMcc4wmbdISmVB4=376

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608919306320036"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3672 chrome.exe
3672 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

3672 chrome.exe
3672 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe
Token: SeShutdownPrivilege	3672	chrome.exe
Token: SeCreatePagefilePrivilege	3672	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe
3672	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3672 wrote to memory of 4760	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 4760	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 1084	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 4348	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 4348	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe
PID 3672 wrote to memory of 764	3672	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uruhbfhjhsfdh.pages.dev#?email=d2lsbC5pLmFtYnJvQGdtYWlsLmNvbQ== /1/0101018fa1781184-b2b56582-f4f3-433a-bec1-5584007ab178-000000/KA-4jDVMRvKzqMcc4wmbdISmVB4=376
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc22aa9758,0x7ffc22aa9768,0x7ffc22aa9778
2⤵
PID:4760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=216 --field-trial-handle=1864,i,17366596237294785166,10120309580295824539,131072 /prefetch:2
2⤵
PID:1084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1868 --field-trial-handle=1864,i,17366596237294785166,10120309580295824539,131072 /prefetch:8
2⤵
PID:4348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1864,i,17366596237294785166,10120309580295824539,131072 /prefetch:8
2⤵
PID:764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1864,i,17366596237294785166,10120309580295824539,131072 /prefetch:1
2⤵
PID:1292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1864,i,17366596237294785166,10120309580295824539,131072 /prefetch:1
2⤵
PID:1932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1864,i,17366596237294785166,10120309580295824539,131072 /prefetch:8
2⤵
PID:4344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1864,i,17366596237294785166,10120309580295824539,131072 /prefetch:8
2⤵
PID:192

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3612

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
3766766bb4ea3211a92534e8cdf95e64

SHA1
646d14c0dccae832310c647cb4ed2cbdb6748b2d

SHA256
4168cf56fe7acfec51a6406a461daa321dac0f4736ff9e42092b5862c4ae50e5

SHA512
df9156cdd62f80ab12d26a9c46e8249dee14b0935030c2e48567a31afb392a8bff2914cecb5d019638938897e8279c1ebaff9f5f4331c58762a412576d05e5af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ca6a9c41f89c6647d6297a5351fce8d3

SHA1
feaacf0ae4416eafbdce8550136b895e0bdf55e3

SHA256
02e8751b786ec6fab66884a9285fc491ba33080bb0f36e66e34572e774128040

SHA512
6865973f38a441fabce59be03707eaf02f2894e0994974251d614756b24325d442a3de1b4f44a63ef470e7160efafd9488e1570d3b6698bfaa6cc720bba29e20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
08916562a33207c103d45d9a517218e7

SHA1
85aa0bb2b1f1898cba4313d7e2436096879c640c

SHA256
fbf0cd8310ee6fad7fe45fc7722ea64eaef3c5e5af9167f313eae25fad4d3a4d

SHA512
70a5d8e4a48fed2640113af68f75aebab899ee7af01e92f13beed4c7e27e66f3a6f08e6790f623445e4278e20b5b3f0d3ac8687d33107ab72d653cdf910cb40c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
bb992df29a8a0eee839ac01741aa55a2

SHA1
07ba35af6015cd359161d75d58cbdea78c76689d

SHA256
a9af648e88d44ff60665d47f3e1e35adaa4ccb3f08a259129defbf7c95ccc0cd

SHA512
f0fa0de488818808be729f53d2d37c9dba13b5afd88664b3024d0eadf16665b3f8bc3729ac754bff4a565e21fb05076ce9f5027c60bd67ace0a0abeb7425d4f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_3672_WKKDLLMNSZLHRSXQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads