hxxp://neogroup[.]com[.]sg

Resubmissions

31-05-2024 23:03

240531-21xl2she89 1

31-05-2024 22:55

240531-2v9peshd29 1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://neogroup.com.sg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133616697396913415"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 2096	1332	chrome.exe	82
PID 1332 wrote to memory of 2096	1332	chrome.exe	82
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3032	1332	chrome.exe	83
PID 1332 wrote to memory of 3808	1332	chrome.exe	84
PID 1332 wrote to memory of 3808	1332	chrome.exe	84
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85
PID 1332 wrote to memory of 1928	1332	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://neogroup.com.sg
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7fff0ab9ab58,0x7fff0ab9ab68,0x7fff0ab9ab78
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1908,i,3436391815242824260,4820021548819650752,131072 /prefetch:2
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1908,i,3436391815242824260,4820021548819650752,131072 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1908,i,3436391815242824260,4820021548819650752,131072 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1908,i,3436391815242824260,4820021548819650752,131072 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1908,i,3436391815242824260,4820021548819650752,131072 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4120 --field-trial-handle=1908,i,3436391815242824260,4820021548819650752,131072 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1908,i,3436391815242824260,4820021548819650752,131072 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1908,i,3436391815242824260,4820021548819650752,131072 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2496 --field-trial-handle=1908,i,3436391815242824260,4820021548819650752,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
9630c69c3adf40dcffc030297080750d

SHA1
ba304f948c0ea2b6bd322c18f13c6e7b4ed3089f

SHA256
b934de620ce1f065d6f24720f31d2ffb38093b9ac532127f9a13ccfb6788f504

SHA512
d93e9660b646586986c219d294ace41fa0fc432ea5aaf42575ab705c92ef7430fe255fd8c773c5a9ea25cf5ce537e9736f1bbcc17ea3a8f79a31f378be802a25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
710aa638408a8a64e2f4de176cf01f17

SHA1
8f3df9eb91ffdaed8ab3c1729ac576eb49d7aeff

SHA256
f830f73fc197400852236afee22aaf5ec0304c227f1222fcdc0b343a755ebfcd

SHA512
6db93bae076925b1e3050a75e5c2efafd1dd9d235a46e65cc476b4d07c2475799ee84111463bee3292f54410fe2cfd5b5768d2fc5717f7c314b47206ec71d074

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a4ed61df43202802064729391cd67338

SHA1
ce40290f0cfeca344cbe496fa36dd171feb80a06

SHA256
194b88724fac89599582d595f158e93b25361b5d5b07b9fd31575bbc1dca871c

SHA512
73a67e80a55afcaf89f13ca4f75437d47126c1115c3fbb49fe61877a7671b729d621408316c5f838abaa9010fea11298049096ad5b914bff3b4f988dc4e31c16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
d8e6ec915859bf82b0e37fcd28105f00

SHA1
fcc931b3842203eb60645fd9e2f5da1baf428069

SHA256
037251e3805286e47ede33cfbb354ee2e786b802128a8aa09c7cc27c6f6afd82

SHA512
34a1b44e4ca62be7f3000032c460dd464cd308d83c4ea5e037d827d127c92a2faf239417543fafbebd7a3b762d8a978e7c03f6500da0818da095f1a2822a2860

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
66e86bd7c2d0be6cec01dc7a12ab2f31

SHA1
72fb315fab24bf1964790b8eb1e75842c3bb3e10

SHA256
934a0390ed4b3cb06a3365a47458ffdb224c24313636cbfa7aab895e0be0f12d

SHA512
c53931998fce888e1cc982247c8a27dd0646c91cfdf1e3080d3dd3eaaa976312f55244ee6eb637cf6c6bdf7d75d61f07c0ced31bece1d6f10e94ce21904509c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
03e2b4ac1acde2024acd0085808dfbda

SHA1
753ec7299d397c8b8ed30b3004c361ab884a037d

SHA256
d12d9f8b784e2cb34ea5c547242b8202a2a5fea9bb8ca71c072e9c469e7e3d2a

SHA512
b8ec80c68da5478c4d113aa37af5882290fb373d8b1bf158324a80b14635715b67d320c16b7bd9eb51e23d4463865a3d545f76060c32eceb8eef8e5740e297c6

Download Submit