hxxp://pbs2[.]cpmstar[.]com

Analysis

max time kernel
149s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22/07/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://pbs2.cpmstar.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133661560036213156"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2828	chrome.exe
2828	chrome.exe
4580	chrome.exe
4580	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2828	chrome.exe
2828	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 4772	2828	chrome.exe	73
PID 2828 wrote to memory of 4772	2828	chrome.exe	73
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 32	2828	chrome.exe	75
PID 2828 wrote to memory of 3860	2828	chrome.exe	76
PID 2828 wrote to memory of 3860	2828	chrome.exe	76
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77
PID 2828 wrote to memory of 2324	2828	chrome.exe	77

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pbs2.cpmstar.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa8db89758,0x7ffa8db89768,0x7ffa8db89778
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1780,i,4630289901951501023,4766041876743317979,131072 /prefetch:2
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1780,i,4630289901951501023,4766041876743317979,131072 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1780,i,4630289901951501023,4766041876743317979,131072 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2700 --field-trial-handle=1780,i,4630289901951501023,4766041876743317979,131072 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2708 --field-trial-handle=1780,i,4630289901951501023,4766041876743317979,131072 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 --field-trial-handle=1780,i,4630289901951501023,4766041876743317979,131072 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 --field-trial-handle=1780,i,4630289901951501023,4766041876743317979,131072 /prefetch:8
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3804 --field-trial-handle=1780,i,4630289901951501023,4766041876743317979,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4603d5a5c912a1dd9dbc25ed0ea65c58

SHA1
905ea860d3ee27e0e67dbdd193d32993c8f184ef

SHA256
e91a301f5b92a356c5eaa3e0d26fb79e8ac290109664c07e62931394e37d6fb8

SHA512
539612641f710114b416794d158f5952bad665b3271110c0c1a0c3d17b3ab0db58c74d6ac41d3296c13a45fc815f6995d7dfceb02fff73382fa14d3b359c68ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4fe2c8f3918ecc1f3f4c891c83856b8a

SHA1
65225bf5dc84772113d51bdc0a2ff4fce2042946

SHA256
c1a434a0112d5196a84db7160b9729994a951159ee3175e04c13fa180be15428

SHA512
5523c395345ee707acaadd2e1e3ec150ee60811f9022d51da7d54dfa952b2910a0e9b38f68efaa9d52d0dcaa169dc36edf2227e4e3ecb27c2fddffa361a2ee27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b1481b2104e80221c425ada5e42494df

SHA1
7a02fd12359c10bf12d8653b32df423f59f9b1aa

SHA256
2b9a9b2d6061c0646c52c77b9335695da308032cfafbf7ca7cc68afa6356a18d

SHA512
3982028e34c3de6f46aec38c5d2dae4c53d57b1a5857128fa85a28498b010ee378464aa8e6b9416100891025225a45d1e7bb375623b5fd08bfaa75331fb5834f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
c93d590cd66c4be2bf6e39afdb93d2b1

SHA1
1a4b4d1acf48e4e3369f3f84f95a5ed176b677f5

SHA256
08cf6b1c5e4c9cab2a8727f843081523052d2708844c19c955cc2b35ece88b1e

SHA512
abc2d5cb7d96906d17e26c89277426eae2f914d3f5756e20d77002fe1dbd88a4bd08532a79cfbe68eefc6ca96183dd331020503cd84da21392552b50cc6abebd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit