hxxp://email[.]digimarcon[.]com/tracking/click?d=HTJyLJuTBqi1v5hszdPqFxGbPgxeep0u4kKsFY9ThrXS6HmlHiza3HCvDGfKIIIicbOLSAQqZO2u80n6KNIU8wxaPUqCsc0J5VgDcss1-tDyEG3DLOCrzzWZQyMeOQwz_7ktM-kTcYVf3aBgATakyq81

General

Target

http://email.digimarcon.com/tracking/click?d=HTJyLJuTBqi1v5hszdPqFxGbPgxeep0u4kKsFY9ThrXS6HmlHiza3HCvDGfKIIIicbOLSAQqZO2u80n6KNIU8wxaPUqCsc0J5VgDcss1-tDyEG3DLOCrzzWZQyMeOQwz_7ktM-kTcYVf3aBgATakyq81

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608983847601288"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

2624 chrome.exe
2624 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

2624 chrome.exe
2624 chrome.exe
2624 chrome.exe
2624 chrome.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2624 wrote to memory of 732	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 732	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 4796	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 1580	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 1580	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe
PID 2624 wrote to memory of 3336	2624	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://email.digimarcon.com/tracking/click?d=HTJyLJuTBqi1v5hszdPqFxGbPgxeep0u4kKsFY9ThrXS6HmlHiza3HCvDGfKIIIicbOLSAQqZO2u80n6KNIU8wxaPUqCsc0J5VgDcss1-tDyEG3DLOCrzzWZQyMeOQwz_7ktM-kTcYVf3aBgATakyq81
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90ff7ab58,0x7ff90ff7ab68,0x7ff90ff7ab78
2⤵
PID:732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1884,i,15215238663803187028,5274708982687006083,131072 /prefetch:2
2⤵
PID:4796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1884,i,15215238663803187028,5274708982687006083,131072 /prefetch:8
2⤵
PID:1580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1884,i,15215238663803187028,5274708982687006083,131072 /prefetch:8
2⤵
PID:3336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1884,i,15215238663803187028,5274708982687006083,131072 /prefetch:1
2⤵
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1884,i,15215238663803187028,5274708982687006083,131072 /prefetch:1
2⤵
PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1884,i,15215238663803187028,5274708982687006083,131072 /prefetch:8
2⤵
PID:4808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1884,i,15215238663803187028,5274708982687006083,131072 /prefetch:8
2⤵
PID:1036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4932 --field-trial-handle=1884,i,15215238663803187028,5274708982687006083,131072 /prefetch:1
2⤵
PID:4592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5112 --field-trial-handle=1884,i,15215238663803187028,5274708982687006083,131072 /prefetch:1
2⤵
PID:3228

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
7e5d11e139c7d381884f850be7e96cf0

SHA1
14aca23f4031c53307791b214c6cd5c87b77e1ac

SHA256
85d1da451275155ef03304eb50a3bb85dd25147bc69de6a133159490c1b00a21

SHA512
d261986715518dd7869e2ebff05377ce0abcd339ea5d510ef70c49fd9fca1b1f97c97b97cc87adaa674dea2130efabdb0380de6840c6c19871960335253d9a86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
ba0dfda82eab52d953ac2b53996bea29

SHA1
463ce427450ed5770be2aa05eb4e8cc460768601

SHA256
fb485e301743f824a84216b1b37be16034b94d27e96a72ef66ae6704497effd8

SHA512
ab04a660d809328da8b1cf01727d123ae911c57ab49a7da40ed61772ade5235845d781424ac5b94b49462dd8c6a17c0eb114c39ce32641515cae621b76f34374

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
a51a188b2f793501cf85127a2d850fc1

SHA1
8d1ba296578584bf73a229e7bc0d3c9e4ec2033f

SHA256
3cd0c0f780f2a58e44b56c595cac6a588b18224c9a52895f7c25b77c03716d5f

SHA512
10e16957e460d98c390fcc797624236b5f9478f539edc93abd70e440d5ecb57f8111d3965088ea0b4a292f8f4d9b839bc42eedbbccdc402b12ffa73c963be356

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
71689cb34bce4052c35140f868924d07

SHA1
39ee211959bf9b6c7ddb88e6ec881c4f0435a276

SHA256
e826ee168421628e32ef5ff40a06f484f2904ddff2c062ed6e519f0395536f6e

SHA512
41fd84dac13998d308b7f81901cfe09b70007cfd3cdf5e695942f8f100a201226aa9bdc90964f68774b7f54449f9852ae29286d43d63c90577e44f1c80f2bd67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
130KB

MD5
1113b427903512d7c1103199d15fac87

SHA1
83158d8bb7b1e3246d2ed0b3007a722cbd23ec7d

SHA256
913ae94d32e926fed8928421a202b6d9360ad02b56cb9fdbc908deb822a6d2bc

SHA512
6c20a99363a736b36486ae4fb5ebe405d6c7debae63f2d22ff3e81b4a99fa4c9f91e464bbd668d7a6287e2f7df40a91982db6f8c632230e1be42af47b74ec285

Download Submit
\??\pipe\crashpad_2624_BQGHSVJXWUGOORNV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads