hxxp://shortlink[.]rf[.]gd/di6q25

Analysis

max time kernel
26s
max time network
11s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
28/05/2024, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://shortlink.rf.gd/di6q25
Sample240528-rt5zqsab65

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133613802240962668"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2124	chrome.exe
2124	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 760	2124	chrome.exe	78
PID 2124 wrote to memory of 760	2124	chrome.exe	78
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 228	2124	chrome.exe	79
PID 2124 wrote to memory of 2564	2124	chrome.exe	80
PID 2124 wrote to memory of 2564	2124	chrome.exe	80
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81
PID 2124 wrote to memory of 3848	2124	chrome.exe	81

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://shortlink.rf.gd/di6q25
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff860a6cc40,0x7ff860a6cc4c,0x7ff860a6cc58
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1732,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1724 /prefetch:2
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2072,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2148,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2168 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2992,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2996,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4396,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3204,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3008,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4280,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4416,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3312,i,13830346752907820914,8431256124694574999,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3296 /prefetch:8
  2⤵
  PID:3528

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68e4a55e-72b8-4ca9-84b6-94ec2d1c734a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\68e4a55e-72b8-4ca9-84b6-94ec2d1c734a.tmp
Size 649B
SHA256 13d85b864369487ee7f8a210d75cbb76f1445d3d57d9dd18a3136a603af63c16
MD5 6ebbc00beb5f1a526b6d050624ea6ac5
SHA1 7a93f15ee6570835cd6b5c6b5a8b27531ce89442
SHA512 dfc60d825702e15329926d69ccc476ec7f13e8773e910a135d29298d37cc00dc4349e8102b9927370af3e7f7539654593bdf89595f032d84e212b591ef595ba5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 b0afc83da922c5c25724bb067f73232e992ca5760321792a3e80cb58d5d23039
MD5 b5eea2e2c5c373793ef4b23fc4225722
SHA1 956a822c50a41b6a370d19cc8f5cfc52e7fed07d
SHA512 bab3d3e227bc8e1c9dacd127a2ada12fcd29c4d6e5936f97b368ef705f6f83e7fddf52ecb0273aa7ef3121fbb1f03c96fc339eff12dc5f521d50da8e88aab720
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ae45958dac21453f9cf24af03cb74e317510ae3e4e9377a932705410c1692bee
MD5 ba3a0551121af68b83722619c27d8c7d
SHA1 5cbffff46ce787d44e01ab42c547a07b8b83d742
SHA512 008117d087381c6aa001c28f1d85f74e277629dcb5465884b1b14bc79c4b1e66fc8c1d0f23597b4fb874298aeb9f90779a6343adead9952087e817a14be3db06
SSDEEP 192:QMQXqFsMO48eZe+PH9zlmYNr+F8PKgkBebHj2ynRO9Po6yIsnVdg4:QMQXqFhO4v/9he8PVkcHj2YO/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 65fac221163fafc552c2e814d7c9a19be3be025ca0ef91c7a68542490e48f452
MD5 b1b8cc1cf8f51fcd8e1d1af66862392f
SHA1 f6d4e173f10ca9d1dfaf431966765153b847f17e
SHA512 79a6466e8b531d40f3cdad882b1280374ea15fa9dd1a8387e4a5deebc920640d8dbff5442033c05753189249bedea89cd36640db49cc0ceb77b8d5d74fe35714
SSDEEP 192:QMQXqFsMO48JZe+PH9zlmYNr+F8PKgkBebHj2ynRO9Po6yIsnVdg4:QMQXqFhO4u/9he8PVkcHj2YO/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 77KB
SHA256 ad29c932e8579b09ded6dc28c14ef7e48e71961bb6347510399e22a42f4ac45e
MD5 30a4cb7344f0103f5a968fe53312aee6
SHA1 8a8bf6f70b60065cc7b94433462b422915ef8875
SHA512 a66f6b6099af7194c5cb97d4c486f0362750cb7ede7e1e1476b74449af3cbe0387be72125615ebb89b19d74b7f8b834975d57eb067701f60fba3c6687c605872
SSDEEP 1536:1Cumvprt5iWIc8Obp8Dy9drEltd6Vt3nWvQoFQGeB/9WoIawoTvPC:1Jm9t5iWUEp82vQ0QaD9W3aPS
MD5 SHA1 SHA512 SSDEEP

Submit Download