hxxp://rickara[.]com

Analysis

max time kernel
25s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://rickara.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133685609070291460"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4940	3108	chrome.exe	85
PID 3108 wrote to memory of 4940	3108	chrome.exe	85
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 3356	3108	chrome.exe	86
PID 3108 wrote to memory of 2692	3108	chrome.exe	87
PID 3108 wrote to memory of 2692	3108	chrome.exe	87
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88
PID 3108 wrote to memory of 4644	3108	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rickara.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff86503cc40,0x7ff86503cc4c,0x7ff86503cc58
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,6309787093232256692,3573617677540061613,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2028,i,6309787093232256692,3573617677540061613,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,6309787093232256692,3573617677540061613,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3036,i,6309787093232256692,3573617677540061613,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,6309787093232256692,3573617677540061613,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3744,i,6309787093232256692,3573617677540061613,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4656,i,6309787093232256692,3573617677540061613,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:4364

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\74a731f5-fada-4e72-92b6-8b63a09eb496.tmp

Filesize
9KB

MD5
00516dcc421020ca9dfdfe5c237c0f07

SHA1
5184f4b3c639bda9c517febd54fe72a3e86d1fd6

SHA256
68fc4606fbc749d5293144e365dfa122dab69674998b35f109b01a33c3704804

SHA512
4bf399b83659ec041b40013d9abaf52cd87e5df280d95076f8c8568116a3c3c4903cd45aac86d09f74eb99cb12592fcaa32e7ea9ef2f274f243f3f6cb2781701

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c92ae0789294c49aea831a7c5ed3158b

SHA1
944ba0c96096ac75bd64033ab1c58da33e21a750

SHA256
1091baf60d8b0d8f75f047a50d2c33b296db82cd52f442aecb911b3cd2ceb4f0

SHA512
e096d57224f64bf80ab9f1cc35a6297d058c8bfe301574e66fb410b303bdf90fd15b36d43c6d00da9571e48ce76f8a0f1ff382163ff0ee3911207eefa266c452

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b679716aea6c731e918440c9f90f31cb

SHA1
85d3a0188a45e07567ad84c146d47db0c773da0d

SHA256
cbd35922bdaf21e42eba0503063f595187bb16d5732e7597e15617ac5fc67f58

SHA512
d5c4e53b47f5ffe89130873af51dfd502935a6a5f0fefc449d87f199a65252cdee8765ebc58d3f42b6cead51af282433a299284f0c5728333edba253cd5f911f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
b47e7cc1b5da03a91d21ce6d692b65ad

SHA1
f02d8ebc67033a280c44352b32203b2ce6988ee2

SHA256
f2af3eebba93f5b3f28f0b49e707615f1f175d4127224447b717cd8d0124882f

SHA512
6868aa317cbaa44b416b1897478817bec119e9ea3102f1d66844745a46c24be9b7b64c567787f9ff5e8a110c02ac357137499d5e995098a6ad1aa32e43b83995

Download Submit