hxxps://t[.]me/CFEContigoBot

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.me/CFEContigoBot

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645049939559338"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
6020	chrome.exe
6020	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4588	4984	chrome.exe	92
PID 4984 wrote to memory of 4588	4984	chrome.exe	92
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3576	4984	chrome.exe	94
PID 4984 wrote to memory of 3460	4984	chrome.exe	95
PID 4984 wrote to memory of 3460	4984	chrome.exe	95
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96
PID 4984 wrote to memory of 4760	4984	chrome.exe	96

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.me/CFEContigoBot
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff4a3ab58,0x7ffff4a3ab68,0x7ffff4a3ab78
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1908,i,5537790695883292781,7432125158992238441,131072 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1908,i,5537790695883292781,7432125158992238441,131072 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1908,i,5537790695883292781,7432125158992238441,131072 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1908,i,5537790695883292781,7432125158992238441,131072 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1908,i,5537790695883292781,7432125158992238441,131072 /prefetch:1
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4396 --field-trial-handle=1908,i,5537790695883292781,7432125158992238441,131072 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3060 --field-trial-handle=1908,i,5537790695883292781,7432125158992238441,131072 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1908,i,5537790695883292781,7432125158992238441,131072 /prefetch:8
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4556 --field-trial-handle=1908,i,5537790695883292781,7432125158992238441,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6020

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4408,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
142a8f8289038917029f328dbdc6f597

SHA1
8c35740204d54abf6204452d97437d47c94b7878

SHA256
e2608c4c7c678304e28a398b70380101af11449452536cdc0568ab02879ae0cd

SHA512
5426745e26827bf94cde7e5790415ed0b512fb757ade1f752685ee83bd682559e9d4950f0729dc033c48a5c1ab3c8d3cdbbb72f038bf3500d4285e59b8b9eab2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b10a3e286548479c1c035aefdfa5c05c

SHA1
e5c9c4b45d272be112767b229c5878441da26bf6

SHA256
ef75258bc0caf01425f574d2383bc89b0d14c832829ff6c2e52e5ce7822c696f

SHA512
e236d029864a9899d73e500b025239bfc636081ff32d27e383d32e5bc06697b5034443368a0c6f82be26178a741fddf31bc7a44a3f373ecfa21421182ff23df2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
b469cef6a4730ca3c6af2f34f5522668

SHA1
3687d2d30450f34b0b4531ade3d490d5efd14645

SHA256
4c04c60eaaca78b5b78a00f0f306cd75fd5e535f670d37464506767b206e6081

SHA512
6f455f94e64b2839f4a8fa4dce495741c6ce3d08d938d8e2d833685ea4c31848b0fdecd7ff53116fffe84c7ad660f8ad376e7bc82618253fe5b5953cc73c65b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
81cb87e4c9a491150e90f74af46f22dc

SHA1
b88eea10254d995796c3c7bd5d11c6992c122d2e

SHA256
e5027c23cc477c5363b7da1456bac448dda2d46186f2234f29deff7355c2667e

SHA512
fcfc30ad635fef75a0ebf7b46a30f8dea4614279ad6f806eda93bc0722bd98d639d6292af6f97ec34dbe6a13911d59d75a824206b51a964fca4c937e28900256

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
03d8d528e6c81c5aefe8a0936a44a0ab

SHA1
ac71e9b33b1c5c6231487f714a8bdbc58bff9aab

SHA256
a0e1e7ef04ed8bb2e797d009e0cfc2a38a588d951b7ed2800c792f32903895ef

SHA512
70e7e0e4a0f7001786672062ebcfca9e578a6ede193797326d675a339b4b3efa1e55e8fd34fecfcc056bbf4488159a1f978a842a84fad852cbae26e2feab220f

Download Submit