hxxps://gofile[.]io/d/CWBZ0R

Resubmissions

16/06/2024, 15:29

240616-sw2krsydjd 10

16/06/2024, 15:27

240616-sv1xvasfkr 1

Analysis

max time kernel
46s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/CWBZ0R

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133630253028325321"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 3884	4620	chrome.exe	83
PID 4620 wrote to memory of 3884	4620	chrome.exe	83
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 4028	4620	chrome.exe	84
PID 4620 wrote to memory of 3676	4620	chrome.exe	85
PID 4620 wrote to memory of 3676	4620	chrome.exe	85
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86
PID 4620 wrote to memory of 4596	4620	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/CWBZ0R
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99247ab58,0x7ff99247ab68,0x7ff99247ab78
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3316 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4376 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:8
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4560 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:1
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4180 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4668 --field-trial-handle=1864,i,9155346299828396473,17292370480617380771,131072 /prefetch:1
  2⤵
  PID:4832

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
090b12d2954f512f68a6519d9bc51f40

SHA1
8b5c73a516fa8f81700fb363f2c198194ca0aedc

SHA256
b8060c5f3e3c657b14b93c18a569cc1f151fede97c09c5836ec59ae3bd347ed5

SHA512
c178210dbda048cab42bc7fffa2f45fe05dc340163271d774216e2adc8141a8c1f81d46c00cb711480e74e24adb283f32ef51423e0d210de7601fe4b25cfad1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c1104190839bf39fee8566431128bb94

SHA1
8ddb80b2fbdcc7648368b1c95edb2e1091ead925

SHA256
0cb0863888a8362564c41e9b3981cba881a3aab1f0a01f4fa3d49711aa183deb

SHA512
eca6b9e6ab9e0774504ba68bcd39cb30e5d8ac20dbd58dce0f5358c6b082affe16baa3c9cb8dae781ea150d38e1c4c0a9cdb42c1148b2639fd96b38919483fe6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
b0c8a825a254420d196eeecde36a04da

SHA1
3c8368b8330717c1dff8ee2a8542536ec1e7983c

SHA256
34340c2088c4daf141263df29edfdd3d4f5c778afbb554cf7a705eae8bc89535

SHA512
0be9a8eb28b8666e6a1954ed8da75880c5e852d7d63561da9ee5104694dafe7dd6453bde95ad90ccbbc2f7e8742ff19fa3c8ad3d662627e0d1c77c32195c52ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
fb430b3e40cc56f46920f5156a842f0f

SHA1
29acf3b8ebfa824e63159f6768bca25697429544

SHA256
143531f1ae86a77a98f8524a0ae559d39cc058ba135ef8e65cbbaa3dc0578669

SHA512
38184296cca7df0f39e010e6cb40c71bea94d1227d475bb61cc4e7676877833cc2cbefd0ef44c4751b0a788b7acf2b97eaaf9d9e5b7cf647a7bf92ac1db0c7d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
91KB

MD5
87597391030b902c3c23e1f130d59526

SHA1
936d47939526036392c0240d9cd7e078054f9d28

SHA256
2ed3eaa0f0c3cf03b23f5acd79e5ac72c51b37cf4aa4d77d12e8a01b2cda4d3c

SHA512
1d4ec13b491c744bcbb4a57b37b3b2947f4cd04cb136acd39014c25d7e49f05ef54f3200a5f3ca59cc03ec31acb3727311adb08ad6e091d5121b4c1eaf3f2793

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57e81e.TMP

Filesize
88KB

MD5
89128e5bdafe379ccdb80a7230c5a20a

SHA1
ca0fbfe59f083e94e9cbd1d4d8e1a5c9afecb6c0

SHA256
2f0fb91f69adbd8e3cff4ebdf59f45d66a2e023d5ec137d48f90aa7e52d0a6df

SHA512
2fbb401462866429f1eadd74fdc4f3eef2e20c89eb3b6a7e80f90cdd4492ac82fad44ad86006fb950adf18c4ef08d30f7887bda8249cc22053c2c90d1dbd128b

Download Submit