hxxps://v[.]gd/kWxpzs

Analysis

max time kernel
149s
max time network
138s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
11/06/2024, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://v.gd/kWxpzs
Sample240611-ps5apsxemq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133625829986652642"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
2660	chrome.exe
2660	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1452	4776	chrome.exe	73
PID 4776 wrote to memory of 1452	4776	chrome.exe	73
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 4972	4776	chrome.exe	75
PID 4776 wrote to memory of 3604	4776	chrome.exe	76
PID 4776 wrote to memory of 3604	4776	chrome.exe	76
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77
PID 4776 wrote to memory of 2532	4776	chrome.exe	77

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://v.gd/kWxpzs
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffbe5449758,0x7ffbe5449768,0x7ffbe5449778
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=2028,i,872878315849456266,15630601651347952507,131072 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=2028,i,872878315849456266,15630601651347952507,131072 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1836 --field-trial-handle=2028,i,872878315849456266,15630601651347952507,131072 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=2028,i,872878315849456266,15630601651347952507,131072 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=2028,i,872878315849456266,15630601651347952507,131072 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=2028,i,872878315849456266,15630601651347952507,131072 /prefetch:8
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=2028,i,872878315849456266,15630601651347952507,131072 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 --field-trial-handle=2028,i,872878315849456266,15630601651347952507,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 546B
SHA256 f84a59883f2b2c417ab0025a953ab88b8dba88ebf77571639c6709adf906fa94
MD5 74f5287708aa9ba0e151bf89f7dc7aa3
SHA1 2b6d85be0dda5f339899215e327155a01c99c15a
SHA512 fe87a0a321dcf579c604eec346d1f6bcbbedce5e1d966f01b428cf6863287f5ebbc5057f013f1f76c40698ff11907cb242491da53696a6f8269b587d86148c59
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 538B
SHA256 0627306591a282aeb45756336530fc0115d773c6988bb18e8c85b134d60174ed
MD5 b40e1a07ffb7fcc50b0d113b64e29e14
SHA1 4aa61bd9cf94a62511529afcdb7619080977a854
SHA512 423ef128942754a6a43875e398945051b3d03ecae32f9d50db53cd4816ae480ac1db150e11cbdfd7073109384a6209ffcd55aae27926cdb389eebbf4734466b1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 fb33d1f53763e64a4462fbd48fbc3227b04fd652d47ade7e6e37c96b5ccbd081
MD5 9bf9206aab648b2853c7b728c8aecbae
SHA1 d73686dcc5ae08dbb0c633f6f772ab928249e6e9
SHA512 0ae6a2f646b5345dd1a2e45d6489325697d4ba5a9ed4323e08eb50fec1737e55e8b16001377c429d58090b592d3a0e1bdf68765d2126ad558852891fd453ab38
SSDEEP 96:YYBeKIeLmhZ8iZRy7Di+6MsmdeAkD1QOlQrhw+jVhYtjEsXt0/cg2Vup:YeeUqhZ8syy+FXkDqe+otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 4049f88cde1b47e08259c45d44f8ec0d0f72db2e9554fd812d76671c4588587b
MD5 58f547bc62b9c1831c30fa01c3f349d5
SHA1 7f6e9cc2cb3468cba83237e66ddfbb2fe037fa8c
SHA512 ff3009a2380b553b23bfdc97da09812c166fad1b8d0a368341cbbb4acd3f90eab685c7f6d02730e9099fb9614599d3dace62e98335357be2da3aa4e77d538d69
SSDEEP 96:YYBeKIeLmhZ8iZRy7Di+6MsmdeAkD1mIOlQrhw+jVhYtjEsXt0/cg2Vup:YeeUqhZ8syy+FXkDLe+otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 b2dffcf8669cd38ef98aa4c394eed308dc915fa21d04cb9e3241193aa5c23e0d
MD5 94c9eef9525fb9ed632eb6d7e385e015
SHA1 cdc373fe510690db178caf3072a3f6ed46f104ec
SHA512 589d1ce0bd8f5a76efa9c528d541d1366837ff1ede2427356e67b473bbc36b78fe24ae2879a4c05e6215b5d210854ed9e35a9ac6efd41e0337a91ff05e948e2c
SSDEEP 96:YYBeKIeLmhZ8iZRy7Di+6MsmdeAkD1yOlQrhw+jVhYtjEsXt0/cg2Vup:YeeUqhZ8syy+FXkDYe+otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 136KB
SHA256 fd21f1e96528fd5ee40477e1e19e372fec0340a05c2d5cd90481c948d0795e00
MD5 8030bd2a516ccedf243ba83934abbeda
SHA1 a4d9f146a49fea1f9d691743954f7e21fe2f2cfa
SHA512 52535f49573c556bf0aa9f7ae736018a08e533669ce07e7be3f40a759b085516a59d5c4664925f9780bc0f7ef19d9366e914b581ef51d4fdd50c0f7c2fedd853
SSDEEP 3072:ojHQ1gH0C1nkGXmeWSyXHklNcGiiRn2a8EsS:eHJ52My3klNli6nll
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download