hxxps://assessment-letter[.]click/bb/

Analysis

max time kernel
300s
max time network
288s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://assessment-letter.click/bb/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133610000811479657"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4932	chrome.exe
4932	chrome.exe
3956	chrome.exe
3956	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4932	chrome.exe
4932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3088	4932	chrome.exe	88
PID 4932 wrote to memory of 3088	4932	chrome.exe	88
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 1136	4932	chrome.exe	91
PID 4932 wrote to memory of 4280	4932	chrome.exe	92
PID 4932 wrote to memory of 4280	4932	chrome.exe	92
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93
PID 4932 wrote to memory of 5080	4932	chrome.exe	93

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://assessment-letter.click/bb/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7fffbbd9ab58,0x7fffbbd9ab68,0x7fffbbd9ab78
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1912,i,911719592707560114,5314088723121515958,131072 /prefetch:2
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1912,i,911719592707560114,5314088723121515958,131072 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1912,i,911719592707560114,5314088723121515958,131072 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1912,i,911719592707560114,5314088723121515958,131072 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1912,i,911719592707560114,5314088723121515958,131072 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 --field-trial-handle=1912,i,911719592707560114,5314088723121515958,131072 /prefetch:8
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1912,i,911719592707560114,5314088723121515958,131072 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3920 --field-trial-handle=1912,i,911719592707560114,5314088723121515958,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4020,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
1⤵
PID:5304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
a58ac759ab362fa8595ad862f4505d65

SHA1
91b7a06dac4f153cfeeffba138373681aefceb2d

SHA256
e48153d60685c19724adc16b779c72f4d6a8d92c6eeea265e8197221ced4ce44

SHA512
2b1bc107cdca4e65e65c8addda9ea768b631609e92d439760cbcb272de6fefe12dfdc42918655d94b93e94d1732b39988ae3e318b5f0e06478c5fbdd8de13833

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
22a87dd86cda0c16c96fa8435f30c50b

SHA1
b60fad2a87eacdf2bb5a23273803167595b76e2b

SHA256
8a43b494f579fafea86afacabaed8f32dea20f4f3985181b0a0a3ef30394383c

SHA512
34850dde890543fd919a194bc3049aac46ea21a1dca0cb447a6731ee5db05d4d92fb378d83af53ff34733ae76daedfa4f15b5546cc0d81e8d1d6e901e4ce3cbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
21b30455647fe05500e233a99da999b8

SHA1
c39b28b599b396d81d4baefd7ec11da358d066d8

SHA256
fb83b10fcfe4e7f1a6ae185023823145d0f0c387e0c334d706bb4e529f4b918f

SHA512
39681062287db68ddd7648bcaa018bda686bc2367a3bb2e2f379e0be8e543e5e688a0d670e99bc8b1d789ecc59607dfb3e82853284350d887ceb8174f38214d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d01b65d329419445ad0f60e1f77b6be1

SHA1
28d3c784cddcd21a824e99f1df443213cbd5426c

SHA256
97b36f1b04eb656e397da1148c6005d0899f689337f68b4d15742f9a92cc1b7c

SHA512
b6473ba114591f81e361352ef6f08c2348f010d301c2ba85995ccebb55d1bd85a1cf812f0b12623841ad66167ad575433becb07e7f5ee3648bfef18510b9864b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
de69286a9f4e498fa576f86a5e07a829

SHA1
c7084887b60d81f64dafea249768c429a26ab70c

SHA256
fd269eda0066aab17cebc309267ff77b881eab027287d6c0717c49425eb1dfce

SHA512
8fddc376ced1ee2a8177d8dc70051239898dd95f7bae70dd161b47365b33ac0f7d84d7e0d93b71e9ffe8fe1c9652aed5eace5ffe183e9ab451f6e7a7572c4c43

Download Submit