hxxp://✅👉ClickHere for Claim Your Roblox free credits Now!!

Resubmissions

15/06/2024, 05:37

240615-gbls2atfjm 4

15/06/2024, 05:37

240615-ga56aatfjj 1

Analysis

max time kernel
272s
max time network
282s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
15/06/2024, 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://✅👉ClickHere for Claim Your Roblox free credits Now!!

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133629034451112742"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1016	chrome.exe
1016	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe
1016	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 3696	1016	chrome.exe	77
PID 1016 wrote to memory of 3696	1016	chrome.exe	77
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4768	1016	chrome.exe	78
PID 1016 wrote to memory of 4580	1016	chrome.exe	79
PID 1016 wrote to memory of 4580	1016	chrome.exe	79
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80
PID 1016 wrote to memory of 1112	1016	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://✅👉ClickHere for Claim Your Roblox free credits Now!!
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80838ab58,0x7ff80838ab68,0x7ff80838ab78
  2⤵
  PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=276 --field-trial-handle=1816,i,4849620846349266361,10530312680166590049,131072 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=1816,i,4849620846349266361,10530312680166590049,131072 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2088 --field-trial-handle=1816,i,4849620846349266361,10530312680166590049,131072 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1816,i,4849620846349266361,10530312680166590049,131072 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1816,i,4849620846349266361,10530312680166590049,131072 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4012 --field-trial-handle=1816,i,4849620846349266361,10530312680166590049,131072 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3140 --field-trial-handle=1816,i,4849620846349266361,10530312680166590049,131072 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4272 --field-trial-handle=1816,i,4849620846349266361,10530312680166590049,131072 /prefetch:8
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4448 --field-trial-handle=1816,i,4849620846349266361,10530312680166590049,131072 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3928 --field-trial-handle=1816,i,4849620846349266361,10530312680166590049,131072 /prefetch:1
  2⤵
  PID:448

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
809B

MD5
ce6f8b3c88788104b511a6473f8bfa18

SHA1
c6bad81e5153ab1d1b6a52525316933dd8944ad3

SHA256
5e0af8992e607fb931de4662e7119b02b5a066d64e73ee4f90d6f10b0864e7dd

SHA512
d0db9237100061e70a795b9aa79275cff34c80c3e767dc835b90fc975a3a88b743de55c25279d4097aaad6207c688c0142089d166340cd744ce14094186bf777

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
fc3740afcf075e8c412f7b867a4f236f

SHA1
ad019d330633a56fc86b24575758a3ce5f9f84f2

SHA256
43617672378d2ebe0bc350447ae230cf721eabdcfb1f78c1d2749f43a90021d9

SHA512
504914be5759088fbcb96efa373f289883b4e633709aa1ac3abb61e10286e7d734ac9100ecd6ceeb243d1b0243b253fba8dacb73abb8077371fa4861ce5e5ae8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6fdd623d743434d77a774aadba25b288

SHA1
f12fad9c60eb97e867e962e859753afdf3e06f25

SHA256
4e03e60fac86fbb4c12da7fcc57dfedd0dcbf69b9700d31a457fa767b2d4b65e

SHA512
97e5a68d37b57ed6a36ade38e46afc8d577bc31b7769cc887b1ca630e23f2f430a39da69276ec4b464abe62797cae872277766a2d448c07314682e589e44567c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
c8207089b8fcda7e41138772067280ef

SHA1
c49f5d272aba2830e39dcb3d7ef0a61cd23cbcff

SHA256
212ebd8fdc713825ccc1bf6072daf608165202f57413a63ff53f7b7179a3437c

SHA512
7d199846fa8a4e8ac8b15a392af0478325a15885678b102608eddb956da7e359ad20ee3bf37882961fb819b969fa66bb41c26948e6e99cfb811439c7aac142be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
25bb27a5f141cebd66e466d89902a777

SHA1
66c460a5e2ddf8cabe2ea6e73af707b4490ccf42

SHA256
b39deef80730940eaf7fff4371536762e9c359ab34b5839e512eaf42212a933c

SHA512
27b0358b375902e7d3cb6abd394338967279c59888ff92347359f5260b8d18c91accbe00d53f95218b6d056345511a7c3294894f9d48ddff5b9bca79a5176965

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit