hxxps://tria[.]ge/240522-z7bbaahb5s/behavioral1

Analysis

max time kernel
66s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/240522-z7bbaahb5s/behavioral1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608866385689555"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

400 chrome.exe
400 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

400 chrome.exe
400 chrome.exe
400 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 400 wrote to memory of 3604	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3604	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2448	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 876	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 876	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4068	400	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tria.ge/240522-z7bbaahb5s/behavioral1
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcca3cab58,0x7ffcca3cab68,0x7ffcca3cab78
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1952,i,4275175563457294786,14952725530866889821,131072 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1952,i,4275175563457294786,14952725530866889821,131072 /prefetch:8
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1952,i,4275175563457294786,14952725530866889821,131072 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1952,i,4275175563457294786,14952725530866889821,131072 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1952,i,4275175563457294786,14952725530866889821,131072 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4248 --field-trial-handle=1952,i,4275175563457294786,14952725530866889821,131072 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=1952,i,4275175563457294786,14952725530866889821,131072 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 --field-trial-handle=1952,i,4275175563457294786,14952725530866889821,131072 /prefetch:8
  2⤵
  PID:1188

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
c77e42195d41197a010faa1bec330d87

SHA1
0a81e3a0cb9ef4a62afec9756fad2f2e9255c700

SHA256
81edd01ff7945b423f245d0106f18205ecb7f54a2d0355832fc516d1eae0c496

SHA512
3d335a3e2c2de91d8ccf1b1ddd5ff8c0d4616d15b811b11b67663b425fec1ca114bb7c7dc777d7ee938234360f500a167e1e3ac812ec96a8c86a3231dd241813

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
51cfc39041fbd8955e8f36520d40b39e

SHA1
fe39c89e1ed2807f3b032c9e327baaccfe096e7f

SHA256
a5b1a4b63f655cbec0e84baad2d5fe009af2b0f71dbad9dc2c5728ce21b6ea72

SHA512
7d8dc4f49394762b66fd094dc08c16b7c97c1276413c895fbadbfc38c1c5c24c522f30120295b77a00ce80d5d6f4a164cf8c34d5d37fe590acf5f9745bf4ec60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2befea15540c6a1b52b05bbb1483c11f

SHA1
43ae2b482116a5e420b06b7d4c85e37c23fcf0d2

SHA256
90c2940ef3b0b265be17faf154e7bb099d228574d62920a5804504cc1ac53ba1

SHA512
4c4b3ba59dc8eee7edcc79594f9bda13f6457e585768654fe0f350cf4d45fb56edb172147fc1d72793fa93345c3234d7609dd2d71d784621a3633a2b51d7b6ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
d5ed5662f5f67c31642292717f9e55c8

SHA1
b8a6f9218060ef11d2f65081198af91d14ff4492

SHA256
547eec880f101a4ac0b6433d7dea7a427daec9cad67af6058e2f6a9297062f18

SHA512
ce8e4addab4c99b6099f0d742d460a050d89836a5de3d90fc46f50b8c4c8b0848d051ab0784f7562e6b0ca0a523cbd859659708f01b8d7a402d78cd355d89105

Download Submit
\??\pipe\crashpad_400_RWEAGNTXLFLOVOSI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit