hxxp://devappoutsystems[.]neom[.]com/Notification_LIB/%22hxxp:///Community_Home/ResetPassword[.]aspx?Token=e812339a-a33e-42b7-b95f-b7ac27db5de0

Analysis

max time kernel
37s
max time network
8s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11-09-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://devappoutsystems.neom.com/Notification_LIB/%22http:///Community_Home/ResetPassword.aspx?Token=e812339a-a33e-42b7-b95f-b7ac27db5de0

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133705093468240404"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3884	2416	chrome.exe	79
PID 2416 wrote to memory of 3884	2416	chrome.exe	79
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 956	2416	chrome.exe	80
PID 2416 wrote to memory of 2536	2416	chrome.exe	81
PID 2416 wrote to memory of 2536	2416	chrome.exe	81
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82
PID 2416 wrote to memory of 3228	2416	chrome.exe	82

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://devappoutsystems.neom.com/Notification_LIB/%22http:///Community_Home/ResetPassword.aspx?Token=e812339a-a33e-42b7-b95f-b7ac27db5de0
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e1a2cc40,0x7ff9e1a2cc4c,0x7ff9e1a2cc58
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,9522868725848632970,14039641168268495498,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2028,i,9522868725848632970,14039641168268495498,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2156,i,9522868725848632970,14039641168268495498,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2328 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3000,i,9522868725848632970,14039641168268495498,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3024 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3004,i,9522868725848632970,14039641168268495498,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4408,i,9522868725848632970,14039641168268495498,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2996 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4320,i,9522868725848632970,14039641168268495498,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:2676

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
6ce4190772aa53758730305cb31a59c4

SHA1
6915969ace8cbdbb4ac58940eaa0d03497c8e94e

SHA256
849a8c85a05c98ea72101fbb59a6d68d2874f2a798d8f2a0a1b122d8916a3228

SHA512
79fb006af55055d6d0048125f10dca15c118b7d96a6b72ba1f51f942adc75860888ebaa314bd7c23d714c458e6f0530377f787befdd402482b80e48e224442f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
519B

MD5
fc9aea477c4c32a18c4004f027e34457

SHA1
ea431f344e7eca6e3b19aaf902926776771bd2b5

SHA256
5200816c4574f0e94bac5650eb1f800606ba97ccd65c5971dd1068d0ea71d66d

SHA512
8db40df81af9bb4f492fbcedbd7ef6fd60b3c5c5bc2e55b37bfb9d060f086f6c0b8eaa974f684de7c79d1d71131e7e38ab67d700192d6333491ec0d2dd3dbf65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
71492ead6bbdce3304804944667c1088

SHA1
8a674aa376a96231eaa43d0aca65617d9666d48b

SHA256
c99e6e80b8ca3dc1b5ab2e14697eb132676139be087e765cb59f44a23b2fa357

SHA512
43e73ab41bc8a284229222be42b90e837e325cd6746f2420fa2cb37bd514f2be625b76063bd322d9597615615fe0fe67d043226d72db22999d9f6f9ee7cc115f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7529a5f8a9a0927d234ce09408afab3f

SHA1
1c3f83a816c101afc2ebd304e337fb84bb106bf0

SHA256
1e664a6fac578a72b20e85a4495d4b51f74b70c225a8707c90fb0fcf733c5143

SHA512
c50dd3820e598c7875eb87d4d43361a28f1a313e9dad223cf7532af33b6eac70c87c2f2cb05e5bb5a5a724b45e28f4b738b3319dc9c73afd167edacb11a4c3f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
b3a1b9b881277a8f680c768ee6908031

SHA1
cdb7ed02af9f7af3121c5599a62303c76c4e9fe7

SHA256
6c437f00365f45f8304b5ad19b4b0091940a5b53e0a04d40b24097b7d891623e

SHA512
0039393bb6b0207d2b72ee18c5364f64d3cc8256a7634146090ea47385f3e7f71a10dd85e1ca41169cd941ba127e3e754ce910b1b4da044c5ee720164cab01fd

Download Submit