hxxp://sheesoah[.]net

Analysis

max time kernel
23s
max time network
25s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
03/06/2024, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://sheesoah.net
Sample240603-jbbdeaga7v

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618733659662505"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 4624	3428	chrome.exe	77
PID 3428 wrote to memory of 4624	3428	chrome.exe	77
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3576	3428	chrome.exe	78
PID 3428 wrote to memory of 3380	3428	chrome.exe	79
PID 3428 wrote to memory of 3380	3428	chrome.exe	79
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80
PID 3428 wrote to memory of 3112	3428	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sheesoah.net
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff54eaab58,0x7fff54eaab68,0x7fff54eaab78
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1808,i,17191266587072968935,2195184192504050371,131072 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1808,i,17191266587072968935,2195184192504050371,131072 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1808,i,17191266587072968935,2195184192504050371,131072 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=1808,i,17191266587072968935,2195184192504050371,131072 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2848 --field-trial-handle=1808,i,17191266587072968935,2195184192504050371,131072 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4340 --field-trial-handle=1808,i,17191266587072968935,2195184192504050371,131072 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4472 --field-trial-handle=1808,i,17191266587072968935,2195184192504050371,131072 /prefetch:8
  2⤵
  PID:3820

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0273f2fe-1c90-41d8-aad8-86e45bd23828.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0273f2fe-1c90-41d8-aad8-86e45bd23828.tmp
Size 130KB
SHA256 375dcd11f54ea70891003d5890c2253fa513fe5526b350d9bbb7a1ecbaefbc1b
MD5 9bfd7d44c6feec88e921c2b64e955475
SHA1 2fd7340a0af13d77876d51775a3591e298cd9300
SHA512 759f48fe075bd45cc338e65ebc6700efe952bc9338b9c0589b1eb9f1ee08e1ca5fcd3e6faf6493f590a3e4a0286e2bc4d7a6b1628a5cc1c90cc4be7a421b019e
SSDEEP 3072:HhSAAL3BW7rdoOXT4uywNAkUMI+9z7MAHQDgOnm+AAOSH:kBWPOM4ZwNG2HNHQF60
MD5 SHA1 SHA512 SSDEEP

Submit Download

6daeafbd-77f0-4c06-ab13-9ecb967257f6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6daeafbd-77f0-4c06-ab13-9ecb967257f6.tmp
Size 130KB
SHA256 f6e75ac94613c5655f4227d82a8e155e1e11b8c9cfda165b5ff9d94fae5b3a2c
MD5 c83a7e99938ca714c5c8309729af1eb5
SHA1 937a644910455cb660a1503b6c25977f5a013335
SHA512 6f472ed8adcd3e7b43fa012a33a0a1869401ed2d875d43c1d2fe2a5d177cf60aba0e7bfeec06ae131b2fd0382d0867a378a102513d07d7aef50052b6e9943934
SSDEEP 3072:0hSAAL3BW7rdoOXT4uywNAkUMI+9z7MAHQDgOnm+AAOSH:VBWPOM4ZwNG2HNHQF60
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 852B
SHA256 b6fe1b003711e6db117389b3da58a65181b01fb718200b16d86c1afc7951dfbc
MD5 f76d7189022d5dd7afc7a65c816c9242
SHA1 e6f254e098b1d7b5e2ee9a520744ef34b3ab1a13
SHA512 aac2560f4c0a392a87af4494c63d440ea6d6ffd4b1b0a6ef794050586dbb901f569d0effa35e9cf4eaed49f83cfb430416fbd1324a6ec453986406ec5fd944c6
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 26abc56752df4abcafad500bee96f26576fec1f98f2c60a228f929d987e221b9
MD5 05205ab817734869766f1fdc75726874
SHA1 763c707b6078e5956b42b19dbedab9ef554ce3f5
SHA512 ed4966f4147c5bd4020e0e6ff3a1098c02c56816dfc1ccfd2c29383e87c170bb827c0109cbc89135ad02413afd3e24d6cbc73bdba0ce2f7ed6d08f43407ff143
SSDEEP 192:JjXBDxsrwFaJjR8syh+F0Cd8xP5tjEsXtScR:JjXBDxw7yqtd8/tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 35c3ade39d22ce5b9c64443ae95882a7ccccaa53eb56e10b878b2da1003d6900
MD5 8363aabb41a33087714b764a6a7aa4b2
SHA1 110ad225775b0602d644329d17e9db1b58b14c11
SHA512 e76867d6c65688b46c73d69ba9060bf48eb835a7041941e7bb26aa12b4f4285dd6caae85a4a9d3cde100f13c4b4bc5a970a54615a46b28fd01a2e6e1fbf408b2
SSDEEP 192:JjXBDxsrwFaJjR8syh+FLEi8gd5tjEsXtScR:JjXBDxw7yqoi8mtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download