364c69709d452c0bbca7b8486cfc0481fe1e53eacf4512180404a56ba3a629e1

Analysis

max time kernel
1799s
max time network
1690s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

1KB
MD5

f3b164553ed214c0e487e619a12ce846
SHA1

00e93e2acff2b1b3dde407162d1fdbf82ab4c5b9
SHA256

364c69709d452c0bbca7b8486cfc0481fe1e53eacf4512180404a56ba3a629e1
SHA512

f8657954d0b96574ceda3e079031de4d31fc77a68e48afb9fa30ad345b616423a412940f39ae7526b1833276ab815f21cec1eddfed0d3de7ca03bfdbe03e17d8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608811759670426"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

4380 chrome.exe
4380 chrome.exe
4696 chrome.exe
4696 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

4380 chrome.exe
4380 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4380 wrote to memory of 3392	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 3392	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4208	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4560	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4560	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 1516	4380	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb7339ab58,0x7ffb7339ab68,0x7ffb7339ab78
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1500 --field-trial-handle=1800,i,5571595113892063000,6131962892238699507,131072 /prefetch:2
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1800,i,5571595113892063000,6131962892238699507,131072 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2152 --field-trial-handle=1800,i,5571595113892063000,6131962892238699507,131072 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1800,i,5571595113892063000,6131962892238699507,131072 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1800,i,5571595113892063000,6131962892238699507,131072 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 --field-trial-handle=1800,i,5571595113892063000,6131962892238699507,131072 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1800,i,5571595113892063000,6131962892238699507,131072 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1568 --field-trial-handle=1800,i,5571595113892063000,6131962892238699507,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
3860710c3f01b9c7f04133a93ca9dc50

SHA1
b43070f695fd01b1a1de05e1670aab3eb9a698f8

SHA256
bd66c1e9e8ba7353d9fdb948cf9b8617984a8f2c26a0eae450c9fbac7980b563

SHA512
4df7077fc0c7b666fa705f3ef57f27ea7bfb3a1ef1c73cba1ccc7a2bcb816e4037ac6878e34e1cd65770cf30d7a842832056b07ade73089cae68df19d0e21b91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c750aafcaf14def3b0532e5def97e005

SHA1
ab7bba7e7354665f5caa6606b8d6381f821b9a95

SHA256
12ec7d9cea608700f39a9ca0648a404c2a74e4d57ec803105dff7a09a0ca2517

SHA512
6cb1f78cac475715c196f8acb8e4c295c4ba2ddb64062ca14a180812d37d4386df1345ea66f8df133d528e4ba530a83a69caf786e0e60d9c9f7c4ed9e642d21d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
43d44566f527cc1e507364670fd6afe5

SHA1
2fa2e400e2e3941964e42db8cda2da01249f0101

SHA256
8902a5f63654f11b04db323f46f360e2434b406bcd910b3e30a798328a9e9ea1

SHA512
dee8c52e9703561997c1f2a475119389972461b769c8c8a20e0bdb624f67cd1121f9212247739f8208243a959db048a418fcc35a5a55ace059ad0d3f92c38b60

Download Submit
\??\pipe\crashpad_4380_ASGOTBGTNUYONQDW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit