hxxp://apm[.]vpce[.]gdw55e[.]ehtosgroup[.]com/

General

Target

http://apm.vpce.gdw55e.ehtosgroup.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608960546067949"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

4380 chrome.exe
4380 chrome.exe
4628 chrome.exe
4628 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid process

4380 chrome.exe
4380 chrome.exe
4380 chrome.exe
4380 chrome.exe
4380 chrome.exe
4380 chrome.exe
4380 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4380 wrote to memory of 2808	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2808	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 2780	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 3340	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 3340	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe
PID 4380 wrote to memory of 4364	4380	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://apm.vpce.gdw55e.ehtosgroup.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb268dab58,0x7ffb268dab68,0x7ffb268dab78
2⤵
PID:2808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:2
2⤵
PID:2780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:8
2⤵
PID:3340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:8
2⤵
PID:4364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:1
2⤵
PID:1292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:1
2⤵
PID:2000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4420 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:1
2⤵
PID:4416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4448 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:1
2⤵
PID:1592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:8
2⤵
PID:4216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:8
2⤵
PID:2336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5056 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:1
2⤵
PID:1452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2672 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:1
2⤵
PID:3228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1832 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:1
2⤵
PID:1036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2408 --field-trial-handle=1836,i,11992711265662170160,16105368938406955069,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4256

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
c02d85b69f40efcd0739455ca853159d

SHA1
53d809dc0a73860c4a9dcfc5bad5a873888b74b5

SHA256
79053e20712a95ed4accd62eacd61298fc82d75467de9bf625785983afac53bc

SHA512
b25e13fcee63a0101455693f56ce536a1048fed12dc75219c9426a6360711b68879909ff21c5c0e93c1f94ec2288602be1ac4912d400780110c83384c0fefb2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
334864a61d1dbd2526fc65368f978eed

SHA1
2d9b1c4cec398c712739288c58fdcf04ca96318d

SHA256
95450b5298a572090575ae7e72dd21fff248fa04933551ce4a5ee79545d7884d

SHA512
f860c61b13c2b0cd2819b947527a8d175053e09508fab6a0bec129c9c7f1ac7b554955f549dd1b4de89e1e6cdab3dfe6159992fdf9127f255afb4157621598b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
129KB

MD5
7e26586a4aea01d10a9d78044f732839

SHA1
bdf2c177cfcc97cb11a0fe83547269afdf8afb87

SHA256
7851636940082bd3a23c02dc5a066deee64b25c317583cef88c1fab50dd2b4ad

SHA512
dc7f6ac7acd70c27f6f83185b5f72f6ea80810379eab17511c81c832afc3d444cdc03725d728127a00934a530ffe08f0ca0c4423d885c07ca51c327c6e56b1f4

Download Submit
\??\pipe\crashpad_4380_LGZYQHGYGMADOKOZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads