hxxp://beautydecamerone[.]com

Analysis

max time kernel
149s
max time network
146s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05/06/2024, 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://beautydecamerone.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133620675537532611"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
768	chrome.exe
768	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3064	2804	chrome.exe	73
PID 2804 wrote to memory of 3064	2804	chrome.exe	73
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2192	2804	chrome.exe	75
PID 2804 wrote to memory of 2820	2804	chrome.exe	76
PID 2804 wrote to memory of 2820	2804	chrome.exe	76
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77
PID 2804 wrote to memory of 652	2804	chrome.exe	77

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://beautydecamerone.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8d6259758,0x7ff8d6259768,0x7ff8d6259778
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1844,i,548816928584292675,14883605987386271802,131072 /prefetch:2
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1692 --field-trial-handle=1844,i,548816928584292675,14883605987386271802,131072 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1844,i,548816928584292675,14883605987386271802,131072 /prefetch:8
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2632 --field-trial-handle=1844,i,548816928584292675,14883605987386271802,131072 /prefetch:1
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2640 --field-trial-handle=1844,i,548816928584292675,14883605987386271802,131072 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4480 --field-trial-handle=1844,i,548816928584292675,14883605987386271802,131072 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1844,i,548816928584292675,14883605987386271802,131072 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1844,i,548816928584292675,14883605987386271802,131072 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 --field-trial-handle=1844,i,548816928584292675,14883605987386271802,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
e3479b49e13647ecb3bf67b1bc8f8215

SHA1
18d240aaff9abe7c1d96aa9c4c9436056c2a8a26

SHA256
6f9e0d87959f33bfc6c704b18dfe001c1738864df2123ea909095982759c7c91

SHA512
625086e2402fce47656b2bf236664deeaecfca2690875f56f6816c683ea55ae175995a5e7de923f2b29b8273e7cfcbcffa9dd8a6e1f8edb7fc05846ff3d64997

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c025786d2b9b640a9d55459e3cf54af4

SHA1
277a827ac2c4d9a9a0108c7289efd48d0f29ad2d

SHA256
0c3cb42f5da577f94509006410d9b8775313627af28502ec54c5fcd6f5a34670

SHA512
999783b398f70cbd2c2f5319bc8025c692557b16195a52ca7189131a1a01bd59cc4020d5d193918c1c79fe518e65f0f0999bb17ea09af96989994353fb2706fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
e998b1b675841dfe7997876328a83274

SHA1
ca477e9fb2fe2d5eaef77734c53ec9438d45166f

SHA256
c7d748151ec5525e86fae96ceeaba26d1686197c2506ee71e5b3100b0f8e63d7

SHA512
77ec6da87b16c397204d370541a5b1a5f9940792d48cdfdd326bc97239e24e6aa409a476e70f3452bed7de8fe01a8f4d1ad5275970c2881429e3605c6ca7bdab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
080e41bcee6f89febbc9fb1193233980

SHA1
58d5e2d32ab2dde186f05c4b1b73840897a77271

SHA256
3106bc1b677f946b23ed37bcea86c843ce83e9dec892ca28bb5bde1bb724cf61

SHA512
a0653e72250f1c5a67b697825a9d306630ffc31b6be67635c4ddb92b8a3976c56e95af270bed5897d92ce22ffab04e3b929a32c2ff387ae3d6598f034cf514d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
11d6f9aa2f1db38d9c8d7d1702dbe919

SHA1
e4d4ec7e538d49c57f88ab3cea844860996093cd

SHA256
c9dfdbd6a218e864d8f610968721eb6032c723c22988beaac85013dd233dbe5e

SHA512
6236c1aed4a6a7faf4b7cec058f503faac93ea82bb092e46079c68beb7c75cea7758ba04bd8e05c4aa65a7388a98546e035cc7326795f6997f47accb7903666e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
59f35de3158900790bbec7be28a6188b

SHA1
f8162c4315554bd3ed109406f0ca4e13e3798850

SHA256
3d4038cb1a8eddff9cc947c2b5bbeb0dea83c3faf6643b5901e99708de692d94

SHA512
bcd43c28a93ce5aaebe128552228e6c27db4d263957ba6f332be5d632295407e6f02e2824234d300eabc125393fadd4604ae6d192f892dbf420eba320aedaced

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
a72c43484604ac075b896f0ab1e94501

SHA1
d8fa57d2f6a36bdcc4650c037b0b8356b313a5c1

SHA256
7f15c254488797149f616ee52c4c583381099d00821f6d1df65ec3d7a9a06543

SHA512
1a7b6d0e6f7b1cd427076d487cb5dd1ddea4bf116435f7e5d678a60147b1370598a8cb1b2e025c2ece739e648db8ca32742324a92019c147c29cba973b17f499

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit