hxxp://Nordenbamfordfinance[.]com

Analysis

max time kernel
41s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://Nordenbamfordfinance.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133706254595277978"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2612	chrome.exe
2612	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe
Token: SeShutdownPrivilege	2612	chrome.exe
Token: SeCreatePagefilePrivilege	2612	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe
2612	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 756	2612	chrome.exe	87
PID 2612 wrote to memory of 756	2612	chrome.exe	87
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 1508	2612	chrome.exe	88
PID 2612 wrote to memory of 2492	2612	chrome.exe	89
PID 2612 wrote to memory of 2492	2612	chrome.exe	89
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90
PID 2612 wrote to memory of 3452	2612	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Nordenbamfordfinance.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffddaa9cc40,0x7ffddaa9cc4c,0x7ffddaa9cc58
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2076,i,17106273272199314847,3531177910292552818,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1864,i,17106273272199314847,3531177910292552818,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,17106273272199314847,3531177910292552818,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,17106273272199314847,3531177910292552818,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3052,i,17106273272199314847,3531177910292552818,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,17106273272199314847,3531177910292552818,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3364,i,17106273272199314847,3531177910292552818,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  PID:548

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
843d1461be2ce7fff81d0e4c139e3532

SHA1
6e53fc93bd1ecabd92c94710868aecbbdb1a2c60

SHA256
08cf66230e407ba3c56cdeb6c60bd921350696baa4c40ab59d1fbbcc44975ac7

SHA512
005b26fd94b969c287f416406d31df1c04d1b2d91f6f1d80fc58503d45a70c931cd0859864ee13679c60f648c9dc50c9985f6e58cb63d092b5ac3a1e3938b7c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
278a26aaab0368f9e9e6f37d80c6e689

SHA1
d31f8b4048cc4063c5352bcffc617098619aefe9

SHA256
4fc462c0a056a4c3528f76f26c6b874dce91cece9fcdc7a8f8d57dd55fc0b01f

SHA512
8cf6f90a5d55036c853d4f4edc06be1c61adb12b10c29b8fd1249efcdd865a9750f176580ba7ed705ab590440b1e413458532d04371fb5665e34cd83a0511d4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b0e09ee9bb22412e113ba24c39eda2fe

SHA1
0d44d74bf5a9eedee1585310592126ebba0aa4eb

SHA256
646c3760c5f640a49a3c8982f27a8c64b3fae32955e90d7a064c1fd1ed19f368

SHA512
80d5f464ebe87655975fbfc73cca369c2a241b4ebb74a8b8d9a519c5c97bcbeceff278d863d2561b0fb17f3362de66f1b7bf980faa67f5ebc7f685129cdb7797

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
59e19618927285129f9c1b277e6eae1b

SHA1
cddd25dc19af16ca51782990075989e117d6454f

SHA256
5625d159450ee8f8f2ee7e6800b3ca882f9eafd73338c3789dd098a0ddac4d5d

SHA512
00f1a141b236893e58ae74d5844fd6342a1101b6373d643775e82eef9f836b51f626afdd048a2665b3f0ae3afbb34a7f7b68fe3113a8a421af678e15e8a9d399

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
55e017976d2c22825bfe827e7811c2a7

SHA1
36b88e7d6b5fd84aaab364271d33742606b4f393

SHA256
628ff7e2c3caa732d66901541fd276b3d5df16a4afa6d0aa95e436086a9e51e0

SHA512
6d619f72d6afb5444994882607e75a0e23081613fc733941eefa612f5c2b379a06d0ea59a1cdd065b59e8d989fea695264236bab38facdbd523a21457f8b224c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
5b9c004ae5a58a7b77affe38ccfb4733

SHA1
0e105e8d20c260236d88070a3db4b9d5773e6cf2

SHA256
036073228424e5967dd1aafdf8b48151a280dba24aa1d9b7a63d8cafb5e07cf0

SHA512
4caf330299b2f3c6920b08281d5b3ea1812db26e0d6258a566ce20b8100257cb5f6997cbf425be9b2bd82120ec6f7f859b7e4faa83b69d5c5a717fe9bb13ef32

Download Submit