hxxps://cdn[.]discordapp[.]com/attachments/1245439556606492742/1250073358071238667/GettingOverIt[.]exe?ex=66699d09&is=66684b89&hm=6644fb2f27306a6035b5cea03dcc55ea9c23f6a137c8d77897cf798f81232330&

Analysis

max time kernel
44s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1245439556606492742/1250073358071238667/GettingOverIt.exe?ex=66699d09&is=66684b89&hm=6644fb2f27306a6035b5cea03dcc55ea9c23f6a137c8d77897cf798f81232330&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133625850769334633"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2236	2560	chrome.exe	81
PID 2560 wrote to memory of 2236	2560	chrome.exe	81
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 3940	2560	chrome.exe	83
PID 2560 wrote to memory of 4596	2560	chrome.exe	84
PID 2560 wrote to memory of 4596	2560	chrome.exe	84
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85
PID 2560 wrote to memory of 3512	2560	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1245439556606492742/1250073358071238667/GettingOverIt.exe?ex=66699d09&is=66684b89&hm=6644fb2f27306a6035b5cea03dcc55ea9c23f6a137c8d77897cf798f81232330&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd092cab58,0x7ffd092cab68,0x7ffd092cab78
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=304 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:8
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4400 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3220 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3244 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2436 --field-trial-handle=1840,i,17980600106795670744,988877166478808514,131072 /prefetch:1
  2⤵
  PID:808

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
49f747951669959eb5cdfe34cf1d57df

SHA1
5d4665f052b366ab7947c635bfa640218410712a

SHA256
a68c178db132e855cbd14696c6a8340a89c74bee22be40233dbee80fd1e93e74

SHA512
e4cdfadf8eb5f16e78997220eba0503fb8ee745babf660e8ef34194ba086eb8187a5ab26df2eea15418e3fb02388b6474697f017bd7731cdf5560fb9709cfaf3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
853838e5fe8fd535e0ad0828f96bbd2e

SHA1
798044abf5f3f24498ee4dad45fcb30a026ebeb4

SHA256
63f2fbde9abb137aa59409ffa34da45309818356a929339932883ff6e4485128

SHA512
daa2e81af3d3f0d26d24594c5c3cf8d380ce3efdfa9e1abbc834e9b79710121e1ca774b5315dfe22378e72ea70913291da16cef33ccc30ff3c7a3141a5c75cf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
9f32e7b84c71925f412086d1b1ccf370

SHA1
029c57b3a118664109d4a20218acf3d00377fecb

SHA256
732bdd6fb7af990956a1acd1c8496dc2033f43fbb66027ec49466e100b402e06

SHA512
82b65ef68fc29b7bf2c9ca199f00a1ab047db169eb522f5ef95e71ad47fe6ad0538cfb347bbc15c97e7c96e4d1d3f00aaf7001a8357d153f32f6d46e6e40250a

Download Submit