09cab7241bd615a918ba1fb6d84f842169ec6a269059b07e6c860e67c081fd53

Analysis

max time kernel
20s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1660fc20c298d96bebb8fefc0b0a0aabf22c9e49.html
Size

205KB
MD5

16910d10aae81ee4bd5dc3ba52b9d90c
SHA1

1660fc20c298d96bebb8fefc0b0a0aabf22c9e49
SHA256

eef5e652ea702f5484d076e4e866eea96a9c5c86bd4dca70dd9a8c9ce45d51e8
SHA512

0a3ce37079d4f2560fb89482f9390343ecb8bebbbc95e8e355ed42f61cc3de4e8202d25fb651079b2a8878264ccc23f1b2869929cf6c8f74a5300c945c36989b
SSDEEP

1536:5+hhQ7bBONCmQhgAsazAMpU5ITiHbyL4NUB+uNkozJqvYV/4jcs2918slk9c70:5+cbBONCmQhrNkozJqv15uk9c70

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133698357038697601"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4920	chrome.exe
4920	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4920	chrome.exe
4920	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 1504	4920	chrome.exe	86
PID 4920 wrote to memory of 1504	4920	chrome.exe	86
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4636	4920	chrome.exe	87
PID 4920 wrote to memory of 4688	4920	chrome.exe	88
PID 4920 wrote to memory of 4688	4920	chrome.exe	88
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89
PID 4920 wrote to memory of 3768	4920	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1660fc20c298d96bebb8fefc0b0a0aabf22c9e49.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb2b8fcc40,0x7ffb2b8fcc4c,0x7ffb2b8fcc58
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,3329641197596875512,7538494432553449479,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,3329641197596875512,7538494432553449479,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,3329641197596875512,7538494432553449479,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,3329641197596875512,7538494432553449479,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,3329641197596875512,7538494432553449479,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4560,i,3329641197596875512,7538494432553449479,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:2072

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c4ec4e12184048a9ff4e83de3cb3c707

SHA1
44e0745f5c4e4255a2b50ba33a2d05409e9db391

SHA256
db64a973523bfbdbf074b5786ae99abd9f1f817a663207b90f7653bf0f83e38c

SHA512
a16d0b149b2908327f772045303200eecbe4dd709092fb201e94c4672b23035322de7ffbd66e307744cb2c61979921fb7c800f4e364dea6bc7bb9fa37e369a11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
193a49673e26ffd56e5bf0e160a14bf1

SHA1
01eafda338069a20bcd78cf841db563f8dd39a79

SHA256
26b82296ab32877c0b67c59b38239b0a3fbf7383bddc13303805ff55d01b538c

SHA512
ec09ed6cd2fb15679c8886583699928f0bdfa78b1543c2e047b711e131eeb4423da4e478f7d32ec735455d4ec900dd228711acc5c3263978eec368eaf2820780

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\efb0c950-5a98-457f-947a-11df74bb2d02.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8873749a87f733ca6fc611379598faab

SHA1
efe143996d780358b672247f33b86d77dde569b5

SHA256
f347c837760db07bfc9f70bd85c144a5df6fce903ca0a39f8256d261847f948d

SHA512
5159355e7b75a125aa461c0bfd7dcfea337c99aac5f7a311ef23f5b5391c1ab5eb3f604ea60039947cb96e4eae832b22e41a456eeb9efac8306d181a24ce9d88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
88f0613e1a916f75bfc00c4264f32704

SHA1
1d530bb5838f0dd6b9cdf7816daa3e793e3a5dc1

SHA256
91c22e0c5264fbf599fffc8f5fc0e1e346abb8c27839ea5a42ea3b3cb5203526

SHA512
7596b77d6adc71eb229e20bcad9daad9fd11cc5252d87b817aefb84548b9ed2bc9ce0b4cae32d1eb69952e61e97d178ef7067dcc590ae720fc079217dd99b072

Download Submit