hxxps://peg3z[.]app[.]goo[.]gl/SCj5L9n7u51kz2wh8

Analysis

max time kernel
39s
max time network
28s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
06/09/2024, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://peg3z.app.goo.gl/SCj5L9n7u51kz2wh8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133701026032470636"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 2688	3220	chrome.exe	70
PID 3220 wrote to memory of 2688	3220	chrome.exe	70
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 1924	3220	chrome.exe	72
PID 3220 wrote to memory of 4448	3220	chrome.exe	73
PID 3220 wrote to memory of 4448	3220	chrome.exe	73
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74
PID 3220 wrote to memory of 2152	3220	chrome.exe	74

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://peg3z.app.goo.gl/SCj5L9n7u51kz2wh8
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb6d119758,0x7ffb6d119768,0x7ffb6d119778
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=272 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3792 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3160 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4584 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5212 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 --field-trial-handle=1856,i,740002337586271802,8825055424941444960,131072 /prefetch:8
  2⤵
  PID:4232

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d278ad1d36122e8cad43c223d30e1ece

SHA1
2643459e7dc8d17fbecacc0be3d634eef74dc065

SHA256
68fe94f6867af7bc00b0d51ccbb97d6605d10528c332665cec5e0a0181baf9be

SHA512
a62a3f56ebced8a9eaf8489cbebb512c7ec55871b46fd9e0e058062cf1cab0816bd1b68a9428894cd8d6a6d1d5767e05bf4b05a5d75f2dd8bbb3b7c426058cc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d2c55d0781bf703e250eed41dacdf853

SHA1
3a2ebb71ae300ca929dc887452c03f3a42f72f36

SHA256
05344113a02ac08b4c59b8d495e6b832c88e2a13308d4b9ec9b05020a590a3e8

SHA512
6d41862a5f0610c1bf58b0a98ffce77266eb7a04d67268ed32b3d4810645fab08fdc8d83101b9b51903da286bb1ba5b04462c6de63b70a56ebbc85964ecddf4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
481c1bcf80171685153b8189c2d38c5a

SHA1
61a9481c554197e736b53a7bf0184099f397b069

SHA256
8bf7a3eb6cb72a07389c5dbc9787d7f17080070e4c03cd096d7449dbc42e7202

SHA512
426d331dbbcfdf958899a90e59c42cf2f65f6683425852c8d3749ffd659982a8c529d687dd58a92cc71fef0bc905314d2a5f81fb57eeb1843695d0321930cab0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
21981a96ee38dcc0ca77443c983f7781

SHA1
42a534db0fbed71158b06d78718cbd26a1a25b5d

SHA256
02bb47beaacc33962530a56b3c30b6732b59a6f925ae2d558319f7a81e3e811e

SHA512
934ccddb925677e4f5eb083429acecd1e11808b110d7a08c344765f98c8d8a1bdfcb3cc1e9583223ca2c423901023a03a7506a32eb6726eb50818fab90d2d40c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
c16efc12cc1e9aa4d2eefa6c8f585019

SHA1
dd6e22fcb7c824bb39c320ed390c319ed9ebd5a9

SHA256
50151d045bd89c8ba8ae077190b7789ce07bc0cdf1a83898e760d1a437315b65

SHA512
f89a14b454ae2fc1c39ccfb7d948d95d7a924bd946d8f02fd7bdde74fd73379f478e6e9e17a2d82c1c230ef9ccebb73a5ec0693bac6418353dcb2acc30fe30bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit