hxxp://googleweblight[.]com/i?=https[:]demo[.]site4clientdemo[.]com/[.]well-known/pki-validation/hereme/54632/4563r/12345@naver[.]com

General

Target

http://googleweblight.com/i?=https:demo.site4clientdemo.com/.well-known/pki-validation/hereme/54632/4563r/[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609002217515187"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

2412 chrome.exe
2412 chrome.exe
4592 chrome.exe
4592 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

2412 chrome.exe
2412 chrome.exe
2412 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2412 wrote to memory of 468	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 468	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 2364	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 3388	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 3388	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe
PID 2412 wrote to memory of 4184	2412	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://googleweblight.com/i?=https:demo.site4clientdemo.com/.well-known/pki-validation/hereme/54632/4563r/[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee7ce9758,0x7ffee7ce9768,0x7ffee7ce9778
2⤵
PID:468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1880,i,17951116686206873329,6589726741567306543,131072 /prefetch:2
2⤵
PID:2364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1880,i,17951116686206873329,6589726741567306543,131072 /prefetch:8
2⤵
PID:3388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1880,i,17951116686206873329,6589726741567306543,131072 /prefetch:8
2⤵
PID:4184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1880,i,17951116686206873329,6589726741567306543,131072 /prefetch:1
2⤵
PID:3888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1880,i,17951116686206873329,6589726741567306543,131072 /prefetch:1
2⤵
PID:4976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4588 --field-trial-handle=1880,i,17951116686206873329,6589726741567306543,131072 /prefetch:1
2⤵
PID:700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3188 --field-trial-handle=1880,i,17951116686206873329,6589726741567306543,131072 /prefetch:8
2⤵
PID:2316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1880,i,17951116686206873329,6589726741567306543,131072 /prefetch:8
2⤵
PID:3344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3520 --field-trial-handle=1880,i,17951116686206873329,6589726741567306543,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4592

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
826B

MD5
26cad466b7f35b2951837f5ec34d00a7

SHA1
c8431795139fda5d5ee241080211eb39761d6495

SHA256
7b829ff866bd5dac03505ff4de1617a1f8548ae484c74ebec57c1273e3e0873c

SHA512
bf615e5b41e76dcf5e8501cd7ce8ca123e6a278261eafe25da69998a12667d11aae54a07973651d98743785d467bcbc052bc691092699715af1b801a68fab367

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
61bffefb76dc4b1c52873c2ec4123d3b

SHA1
d7b241bd3918a89811aef398d636351a44059425

SHA256
ee7f7c66682e721acbfec7116040e51c542a5d97a51f0b904fe4b3a8edb88dd4

SHA512
d432e68c91c344cbbe7ee0f860975b0c7a735f0d2b82cfc73ee02310bc61d30bf6895cce1967f7217316a9754cb255c66d46dc53e0efd828067306199646506b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
47a314a45c74200553add48d3baed3c4

SHA1
86e1cd8c21e39889ed80efb5b355769d3f8e0dbd

SHA256
a04c22f4274dcd3a29ddb947f292c34b76dd4d8f809b525dce4eb2becab9b2db

SHA512
931d956d112431e3931c32789555488d2847c9902596262563e8c8ac780d6f427fe04ce414b4224c3755406d62fcbd73c6158105e7134ac9042621a563f08511

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
415f1af0675712a656d159010832e316

SHA1
b0fcf7e4461a2d4bf123ab3ceb5bb1c0b3c18a89

SHA256
adbc895c51318e47bf2b2aacc0c1c1ac93fc6269b445b957b6ec766851192b20

SHA512
e4a1bce85e897728bd94f32c393e829787a9cd7c7a06ff253a96ce066362f107331a2d81a2213fcd0bea9be51f5be86a72e350bcafb4b26567e4d0ae7cd8aa3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
0820887c94b79bbd477da8d9058abe79

SHA1
a4329c4c6edaf893e6609fa8e47477ffe2973c5d

SHA256
3d5395665d83525ad704274a83133afd2dea837e0cbf249c63a00b12c890a05a

SHA512
f5d0edd1c7087571ffe5c987e6d65717f9ebfc3cd43bbd244fe82770b033534bfbd0f00fc844128aa6e2c6f0ed9c2ebd443f59a261629cf624244546613230f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_2412_BQFISSPQCLVWONVX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads