hxxp://<hxxps://carahevents[.]carahsoft[.]com/go/link?l=2811c0257d3449faae87ca5b73bb7bed&i=6114c2678c4240e79ea767c6260de949

Analysis

max time kernel
10s
max time network
8s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
22/07/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://<https://carahevents.carahsoft.com/go/link?l=2811c0257d3449faae87ca5b73bb7bed&i=6114c2678c4240e79ea767c6260de949

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133661230230727848"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
556	chrome.exe
556	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
556	chrome.exe
556	chrome.exe
556	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 3144	556	chrome.exe	81
PID 556 wrote to memory of 3144	556	chrome.exe	81
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 4376	556	chrome.exe	82
PID 556 wrote to memory of 2872	556	chrome.exe	83
PID 556 wrote to memory of 2872	556	chrome.exe	83
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84
PID 556 wrote to memory of 1464	556	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://<https://carahevents.carahsoft.com/go/link?l=2811c0257d3449faae87ca5b73bb7bed&i=6114c2678c4240e79ea767c6260de949
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8e8ecc40,0x7fff8e8ecc4c,0x7fff8e8ecc58
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1788,i,7327507585655197954,16146173826006221151,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2060,i,7327507585655197954,16146173826006221151,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2156,i,7327507585655197954,16146173826006221151,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2092 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,7327507585655197954,16146173826006221151,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,7327507585655197954,16146173826006221151,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4432,i,7327507585655197954,16146173826006221151,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4776,i,7327507585655197954,16146173826006221151,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:1008

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
baa11ea83ea4412c3866a7af8b018428

SHA1
41cdf062b0c6d6435a88fd9c1b8a3855cbb2e43a

SHA256
7c9b3d7f0ee9213b7a605842cbdb77784faf3861ff01b5e746823dbc3671480a

SHA512
39c9321c8b935e63dd961a00e639da0e316fb288dd1046b030adca8b22726323ee5803b98e0741c84bc3c34e78ef7010f83451edfefa52baeae9dffe9a8e457d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
95d82d0434c10e1ca2102bb5d3ee3eb4

SHA1
9eb7bf888c18b8770857cc6e5a5c3e7b6dfe7c4b

SHA256
333b593d05d4d871f85901e04d01e7647e78672acbe6e54871e5eb8a6220804d

SHA512
04d6aa829e9029624914694db48fc94cb66d50234dedb51de4facb3cf09411dceaaac02ae96e9da629324fd1a98abb214f64eb60577e04bc17caafada746e628

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
7141c17d258ba21ddff7f4a9eb3ac626

SHA1
9f6047a118c6c595174efed0f96467871eddd654

SHA256
72c32acf1161b39207e1da390486f70ae6d04a4442958da90c73fa90f6ecfc00

SHA512
33bd27e26083c362f117e02204dbb301d88bcd7e0cfbb58d5e8c570c03345069cc0cd15ddbca7612b1a8bc50f263692ee57bae844c0f293790772221ff3012e6

Download Submit