hxxp://up1[.]me/conversation_manager3[.]0/view/privacy/index[.]php?z=1Q9XyNFKWK71kN_p2E

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://up1.me/conversation_manager3.0/view/privacy/index.php?z=1Q9XyNFKWK71kN_p2E

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645168040508475"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1720	chrome.exe
1720	chrome.exe
2508	chrome.exe
2508	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1720	chrome.exe
1720	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe
Token: SeShutdownPrivilege	1720	chrome.exe
Token: SeCreatePagefilePrivilege	1720	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 4052	1720	chrome.exe	81
PID 1720 wrote to memory of 4052	1720	chrome.exe	81
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2916	1720	chrome.exe	82
PID 1720 wrote to memory of 2060	1720	chrome.exe	83
PID 1720 wrote to memory of 2060	1720	chrome.exe	83
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84
PID 1720 wrote to memory of 1708	1720	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://up1.me/conversation_manager3.0/view/privacy/index.php?z=1Q9XyNFKWK71kN_p2E
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff12eeab58,0x7fff12eeab68,0x7fff12eeab78
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1832,i,18073206253155322845,12824531261221195167,131072 /prefetch:2
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1832,i,18073206253155322845,12824531261221195167,131072 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1832,i,18073206253155322845,12824531261221195167,131072 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1832,i,18073206253155322845,12824531261221195167,131072 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1832,i,18073206253155322845,12824531261221195167,131072 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 --field-trial-handle=1832,i,18073206253155322845,12824531261221195167,131072 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4492 --field-trial-handle=1832,i,18073206253155322845,12824531261221195167,131072 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=996 --field-trial-handle=1832,i,18073206253155322845,12824531261221195167,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2508

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
8fe17eff19113bf3a6693c0457de3d24

SHA1
d774197bb00aa102ffebdfa01a35a134aacc4648

SHA256
21792e756855605d3b5022847c3cd899d1ace341703f7d2363bc82d4a4567b78

SHA512
a4beda791829910535b4d1461ecaeab1e3a9d24d0f9d7ca81203599d24f702cf6bf0e0499d1ddf32ba5df27f5b07dc7cbbfcf82ee892b3597f755a5f1891a9a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
5b51af83a6b52132e11a231bfac80c26

SHA1
ca8654b4f07b9a5f847929e9c7fbff1ee557dc0c

SHA256
2879be5a6df876d0e2bc94bc80d7a7acfd1b032527e495948e701e3fc6bb0b01

SHA512
0289de538b129671df03478416e35c42c0197b9026de1527424e4bb04cc155f64e0a50788ef874973c30803b62b0d6139c0647a055728d630d6e979a7e542fe1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
76511edf004857581116d8c162ef9703

SHA1
5f0be06fdce3c9201fd8567f58ab5bb32839a962

SHA256
9d44c7868d4679a9ad3c372a290090b9aaf130481b27eb7993f7fc483ebe8b31

SHA512
1158c7982ed39e1d3d74035e7d62993d34a421f2eb5ed90c510d89260fe5e25e94d152e968eba015297ea28368fb5526674d20b3a2e426c6775e2a2e104a7b5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
857f4724d97bb86d50e8999baf822bf2

SHA1
c5b249c6ca4c34123ece25dc93f49500252ab00b

SHA256
f0e7b0bd879effeebfab25c10abd0595cac67a4b72499cdf3e5b6d0c3e1ad373

SHA512
1a449464bf7abe610a58986bcc84d430748329dcfc370e8e8170662a4c93bd82e2886a2fa69619e691df8200fe03a4df53695031554afded4e4637905f7fc7e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
e4b6b81bf6d27e191b1b2e3f6fe66c1e

SHA1
5379834e25ce5cba12ed420c5809b3ca6a200e57

SHA256
3ccbec5523409638e1f684c80d42706a51f3a79c20fa2b7abb084ebdf8874b6a

SHA512
00b54b0ea96404d59ba2797fca0028b4243dae46eee61bd04c3dd7c4ab45b0fe7b2fcd400bb5e30e2be30d57de22c042c19c4eecad9e5d7e4ab96b0ac4f61ee3

Download Submit