hxxps://v[.]gd/kWxpzs

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://v.gd/kWxpzs
Sample240611-ps5apsxemq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133625830003086419"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4592	chrome.exe
4592	chrome.exe
4964	chrome.exe
4964	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4592	chrome.exe
4592	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe
Token: SeShutdownPrivilege	4592	chrome.exe
Token: SeCreatePagefilePrivilege	4592	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe
4592	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3684	4592	chrome.exe	82
PID 4592 wrote to memory of 3684	4592	chrome.exe	82
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 3536	4592	chrome.exe	83
PID 4592 wrote to memory of 4028	4592	chrome.exe	84
PID 4592 wrote to memory of 4028	4592	chrome.exe	84
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85
PID 4592 wrote to memory of 1332	4592	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://v.gd/kWxpzs
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa797dab58,0x7ffa797dab68,0x7ffa797dab78
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1720,i,4566633748562194895,10788378754614505096,131072 /prefetch:2
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1720,i,4566633748562194895,10788378754614505096,131072 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1720,i,4566633748562194895,10788378754614505096,131072 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1720,i,4566633748562194895,10788378754614505096,131072 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1720,i,4566633748562194895,10788378754614505096,131072 /prefetch:1
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3904 --field-trial-handle=1720,i,4566633748562194895,10788378754614505096,131072 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1720,i,4566633748562194895,10788378754614505096,131072 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1000 --field-trial-handle=1720,i,4566633748562194895,10788378754614505096,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 918B
SHA256 5e4d8bd3774e4f33b9703d6d187abc0f207bd2a96e607283a289440eee7dfccb
MD5 bafe2a9bfb71b14845cb859555f8a89b
SHA1 722e3e24d3551635b7f4be0524590233917d0908
SHA512 e08c1729dc509593a1043ec6e7b6d2c0390a4c6400d5600f69ec111d13feecce6789ff41c2cfde03bc52eb8ef869f97c1d00a0f73a8daa2af15b83ddabb872fc
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 55a28d7b57d6fa11556a8af10c1e554908b4a9ed6af47eab23d73f89afd38fe7
MD5 7e7202d99a6bce64fa059e99e8b10c7c
SHA1 32b2a8d5b0625a7c7b12dfb2e9b0e1094c12b15d
SHA512 6ba16ab565c6a64d59d6ebb24b3dc9cd7575559d17ea911ae8d9c339a4188a9cf6fe2d8285e7d70dc2a9db2f7549dc53b9af9c38d88dd2ad73f52464bd8eb370
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 7e4971011aea4af016feb90910bc4885cfb0354b134562c82bf59ef260b2f6eb
MD5 51c21c8a916bc9e043e10450ca6ae9e2
SHA1 134d3905ae372ab4448e977a7e772741bd987052
SHA512 2b4ea4b99baa18d590c199ce61761848a84c4cc062b820a9291a73a4bade2ea9db81b41674286a664239251bfee389248a992b06081b316698a742ffbcd2a635
SSDEEP 192:Uaf+Tknf+aJyC8syh+FsjqgOpP5tjEsXtScR:Uaf4kn/y4yqoTO3tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 77c4a049f0e57d139a326fc99f74c5778aa18135a0dfd2620aa27dd0f5e575d0
MD5 04b04c84fb402ac8faccd556373032af
SHA1 4145dc6294f91533c9bd8b9fe6fa21e210886123
SHA512 003ca7e1de37546c84b8914c5013428868332af786df9e80cf80ec566fe2a3222e22f367fc3f7c6ce154fcc70fb6e72b5cf54595bcd9f87ce6879e32ed196048
SSDEEP 3072:6Lwnz4F9teZuyz1nUI3S6v/UDr3dLDiuhcwaGqrksatpp:GvF9te35nfC5mgMatpp
MD5 SHA1 SHA512 SSDEEP

Submit Download