hxxps://dt[.]hrandpayrolltrainings[.]com/open/MTIyNDczMy81OTQzNDM1ODgvNzM2NjllZDZjNDc3OGEwNzVmMzIyYWY0YmEzNGNkMTI=

Analysis

max time kernel
91s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dt.hrandpayrolltrainings.com/open/MTIyNDczMy81OTQzNDM1ODgvNzM2NjllZDZjNDc3OGEwNzVmMzIyYWY0YmEzNGNkMTI=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637121203616193"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4992	chrome.exe
4992	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3728	4992	chrome.exe	88
PID 4992 wrote to memory of 3728	4992	chrome.exe	88
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 2192	4992	chrome.exe	89
PID 4992 wrote to memory of 4728	4992	chrome.exe	90
PID 4992 wrote to memory of 4728	4992	chrome.exe	90
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91
PID 4992 wrote to memory of 1084	4992	chrome.exe	91

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dt.hrandpayrolltrainings.com/open/MTIyNDczMy81OTQzNDM1ODgvNzM2NjllZDZjNDc3OGEwNzVmMzIyYWY0YmEzNGNkMTI=
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0fc1ab58,0x7fff0fc1ab68,0x7fff0fc1ab78
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1852,i,6433003088883458035,8295098156320771242,131072 /prefetch:2
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1852,i,6433003088883458035,8295098156320771242,131072 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2268 --field-trial-handle=1852,i,6433003088883458035,8295098156320771242,131072 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1852,i,6433003088883458035,8295098156320771242,131072 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1852,i,6433003088883458035,8295098156320771242,131072 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 --field-trial-handle=1852,i,6433003088883458035,8295098156320771242,131072 /prefetch:8
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1852,i,6433003088883458035,8295098156320771242,131072 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4548 --field-trial-handle=1852,i,6433003088883458035,8295098156320771242,131072 /prefetch:1
  2⤵
  PID:3168

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2860,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
ee1f3c79c14e4becbdd45fd779d2865d

SHA1
30166867d2866ace94c96a7ad73d6f35c5476dde

SHA256
7792827fb9f1d7436b6e0a11faea4540b1e2d9d0df4422a61e548f8ccb6f0abe

SHA512
a31d91ec3603aa0cb92950c98388b6d134cbeafd03e774d169ed3e2b70ec577981323670f18e296eaad650df63f8a396b64ec5f651a5305b01ebdfcb1f44511d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
ec778ca76ac195981e39d3776bc81831

SHA1
3e0d20d281d00f9c52ac6704ab19a90e0b72d04c

SHA256
ec8782f2cbc3d7711f74f05c5fb5e6026c251d5a9b23024c51d325eefec79c4e

SHA512
9d195db6aaeb6c33efb4a10bad65064e17926e3d628f92b53ea9d62f9ce86b79c0f9346b76072c0d11e421e0246f89854d8507b552757c262f6ca02507914e4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fba562c17c59b376292e3b313b8e2511

SHA1
7ae35bbfd00d9128ea32c33a9d45478c316cd182

SHA256
262995d3b95d04b32d61f64ff185f69e4012e9e9e2f5a6181bbd7186d79d2cf9

SHA512
bbacb85405f28ba79360f15e8ee491b2cd479520ac1434d3ca9e6b0aa1399080d33428ecea013bf150678a7dba0d0f27114e1061de6f5b4e941357278f363121

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
bf91efa5d1815fa4b74bed8b94e9ca88

SHA1
a747117b1af32518db7aa75ed969f5160ff22cd9

SHA256
36656e206669731ca319783299b9fd3be0e4e38bf680b8954f0d2d957e1d86e1

SHA512
dedfc1a91ceb3a598e9fddcae78c9f6395150dc52eb711a0c1f6fdf21ebe53675e03bc367f1a780f48e730ac9bf91ded45b9c64b71efa8faa4b80a58a3a5f721

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b5d1ca405e3e02f35b953ac34ab5f4bd

SHA1
10d93de24eed84e2ab1537eaa187428cb5c5e147

SHA256
5091d850750e7b5a59ba782f89924834c28429abafc41ca68f381c48870b191e

SHA512
6765cf447c4431b531afa8b953f4b9659c30e997a0ff6391f13dd539ee995e5de3b9aaa034936a246fe87edf3e496eebfbd75768859052476909ab9bbbd1160b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
998eb895348f3072ea193d5f5f099817

SHA1
cb0b7aec5d97814d5614b45aaa414f592d3d15d6

SHA256
e15503a5bd8e8b1758e8e208506b6f20bcbece81b9dc28795f4363df48ea60ff

SHA512
5c19c9068b49dbca361702e27f549e40432f188192b1cc23ba8ac012ff99a8b4ccaa603f7ac94b589d396363309b8186c7bdca10748fd896d7130bc083203ad0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
9c43d7ac358d859fa5caa9af549b2d97

SHA1
6a4637001fa78844c1db894518ace43b76ffac07

SHA256
dd270cf226731ae5868c32016e58178efa114ad1d29e6fc244edfbc7f8ccaa77

SHA512
d464004e5a1fb7c83a632d661536d568d6fd3d7f34c04af01d333581502259485270592aa0f87f7a7614c38a74b406c444be8b4231a3db834ee5e5a976bbbbc8

Download Submit