hxxp:// | Triage

Analysis

max time kernel
600s
max time network
488s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133611353110666395"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3040	chrome.exe
3040	chrome.exe
1640	chrome.exe
1640	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1480	3040	chrome.exe	82
PID 3040 wrote to memory of 1480	3040	chrome.exe	82
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4404	3040	chrome.exe	83
PID 3040 wrote to memory of 4616	3040	chrome.exe	84
PID 3040 wrote to memory of 4616	3040	chrome.exe	84
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85
PID 3040 wrote to memory of 400	3040	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e5c4ab58,0x7ff9e5c4ab68,0x7ff9e5c4ab78
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1864 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:8
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:1
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4240 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4388 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4564 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1976,i,10838716285542783200,7762475153270434680,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
02731017db536a56ccf1eaba61b01f27

SHA1
5ed12238804614115e77fc46a5947c1da45329de

SHA256
716fc1d6c9b4bfd7bb1486d4c0fe15d2bcdd25da6346e8ea1e02a71e2a1abc47

SHA512
d1284cd2631860a596d0126591618f3828b36354f1d34cf2d012f30b935424c9d951cf8fb06b3b6fd96533e1381249d32e6ab7aa253937a234f88281a33f0ab1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
004fbadd21f3b18cdc36290f1dc70009

SHA1
b2919558629177919048f81fc0b5ed81d899df77

SHA256
ed44d73a8509449697f0885af405ed9e07d91e81fb445cf13abbaff6f4827b0a

SHA512
c2dccbeede401fdecac903b7a9638ad3e74b7972f666bf99b928af593d7e06a0e00ec1f9b539d90b8a95ae1c5119e1bb97aa782da207b4facc4b14020139a04f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
73f18796862f88cc6972eaf3e871ef28

SHA1
bd2c73f202825dade29f4036bd260bb6d46422a6

SHA256
0d8a8463290ac1bd52a7610bb97b4cf41a3d2bec2e88d199c24e9a41fa310913

SHA512
2bf5e97bca8023c9bcc710faedda81d8210d2fe732acaa4a4e978ef5745f73ab235beecc9611811643fe543a1fcbd2015e0ea6c6cca24ab48b5517d3b588aa63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
f9f9f5edbbb0954b6b187b38ba564f0d

SHA1
3dacca9b5389b0e25c1ec93c8f1db136466e27cb

SHA256
56e63ad5558bcc18e037c337c15eb22cd70481faa62a1d08fbd8150ae13fb1cc

SHA512
0da4585fd1e45d6bcc7dac87111bead5d649d12b5c072b0fa39a34d6dfc092c73bbb4bee2b9ba8f5218c252f2ea68099303bb6573548014f4f3731be4001c4fc

Download Submit