hxxp://www[.]bwlw[.]fhndhnedx[.]com/

Resubmissions

19/08/2024, 13:22

240819-qmnlfazcjj 4

19/08/2024, 13:19

240819-qkxfkawdjb 5

Analysis

max time kernel
11s
max time network
12s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19/08/2024, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.bwlw.fhndhnedx.com/

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133685473813648689"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3904	chrome.exe
3904	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2496	3904	chrome.exe	81
PID 3904 wrote to memory of 2496	3904	chrome.exe	81
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 2764	3904	chrome.exe	83
PID 3904 wrote to memory of 4576	3904	chrome.exe	84
PID 3904 wrote to memory of 4576	3904	chrome.exe	84
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85
PID 3904 wrote to memory of 1952	3904	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.bwlw.fhndhnedx.com/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcef79cc40,0x7ffcef79cc4c,0x7ffcef79cc58
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,3046971428558652679,12508121783233809965,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1752,i,3046971428558652679,12508121783233809965,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2024 /prefetch:3
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,3046971428558652679,12508121783233809965,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3004,i,3046971428558652679,12508121783233809965,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3016,i,3046971428558652679,12508121783233809965,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4408,i,3046971428558652679,12508121783233809965,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4288,i,3046971428558652679,12508121783233809965,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4776,i,3046971428558652679,12508121783233809965,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4380,i,3046971428558652679,12508121783233809965,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3712,i,3046971428558652679,12508121783233809965,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:3636

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c141e64be2729b4be7e7786b9d9bf98d

SHA1
dc4db5023c526c4e960a111c15f96fcbed3b1b83

SHA256
850c55b64f555a88d67266121e9ec48341dbdcab4e98337989556eea7051e76d

SHA512
ce6812d1de01b434ea4990c2fefbbe1d9a0bc48fbc08e0898c68869cd250c2f8f3dbb839257b8d2b1c3432f6583a7dca9ffec205b44bb78b81c631c094bbc72a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bf6e46501dc9275e02a4ded7f34d446f

SHA1
4ad1d9655c93645155ff56048b799c6ff77190f5

SHA256
fb31bc1eac590694b9214c6c8f99e25488df607637fdbaaab9bccc0cdddedd8a

SHA512
662164b5852010b5011d6c6db65fb1e182d1623f5dd59ac920a25db497c5ae254b436bed984c96844105d099698fdeddcd9d1ec0848fef701e95a5fd83c9b0dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
3799fbec367a4963d1f1eda638b8df05

SHA1
eb64cb439b867f78ef5b8dd90bb2c7a3f4490f80

SHA256
5871cb311a81829ad4fe2f392d9c1e22f6e3897eb9ec58b604ed0f0390486529

SHA512
2b517dbf6475186d9e90cb94bc178eaf79c3dd98091b5a7b5ac39a09977ea8319db264384e9c7ab0803ea5902ef9b4d4490f66799e8364953c41956d97428405

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
197KB

MD5
37c320f1fe6de4bc1cd937c0c36fb6fd

SHA1
d30b7fde5eea4bc17153a54de10bff867b0dba11

SHA256
b6f946511e78539afcdb402300fc11c5c174429299d39c470a5a418e4711afc7

SHA512
34b7a341cb8fb480e4b771437c588ddadd6ec843c1136099cfba07d388f02f6400f6801466a82e0a48102f7d2da2988b0a6dae1e947f2c564a0de110551453a0

Download Submit