hxxps://email[.]cloud2[.]secureclick[.]net/view?id=6063[.]31244765[.]1[.]9ae751939d033e1e3bc173ea5d801cef

Analysis

max time kernel
19s
max time network
8s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19/09/2024, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://email.cloud2.secureclick.net/view?id=6063.31244765.1.9ae751939d033e1e3bc173ea5d801cef

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133712333849488771"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2812	chrome.exe
2812	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2812	chrome.exe
2812	chrome.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 1948	2812	chrome.exe	80
PID 2812 wrote to memory of 1948	2812	chrome.exe	80
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 880	2812	chrome.exe	81
PID 2812 wrote to memory of 2576	2812	chrome.exe	82
PID 2812 wrote to memory of 2576	2812	chrome.exe	82
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83
PID 2812 wrote to memory of 1928	2812	chrome.exe	83

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://email.cloud2.secureclick.net/view?id=6063.31244765.1.9ae751939d033e1e3bc173ea5d801cef
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6338cc40,0x7ffd6338cc4c,0x7ffd6338cc58
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1776,i,17830814728778319222,11336215067123286111,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2044,i,17830814728778319222,11336215067123286111,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,17830814728778319222,11336215067123286111,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2336 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3068,i,17830814728778319222,11336215067123286111,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,17830814728778319222,11336215067123286111,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4516,i,17830814728778319222,11336215067123286111,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:2280

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\96e73e8f-01d7-4d63-8a0b-e9307cb068c5.tmp

Filesize
649B

MD5
9e41a6181f96d68ccd5ff8be9db84779

SHA1
2016556d85be5c91f254a1cb659ac1f0e73f2d6d

SHA256
466c65260a4b6e3b9387e99efb99366b128aba74d8b06d2e855fb8f6d54ca431

SHA512
9d568756887dab6f345003656abfa51fdae254cf214708cf7086e316ff38275e7f8db35a1f461b47e49b16b0e5126e4b08f9b74c1b130df400c53d26de8d05ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bc52e01ba8492bc08fe15a05391c8725

SHA1
1fc68ca2b44c338decbe9756c585d0e2d2476157

SHA256
ce904d293e5e8c0f1b354a67c296f9fbd4c733a1474a4a1fa9c7fd2f7d367bb9

SHA512
5777c946e85d19ca25de4db9ea0f146a3e75087f7a4ab417b0adea6a356e8a0f850c1e767c612c471c065ce9bb9aa498ac28bbb9ff9fae9741af257bc0cd80cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
8eaca97442e98fc844c86c1d8cc03359

SHA1
72bcb341dc00be1d2b942a0dc7a435c9128a3985

SHA256
7624327663a686d559bd859063820278864f41084c02e7753e5f0de0f52ea923

SHA512
b3f405276b82dfbe5fcd27ddc31c9967a122bc68272182cdec0c888be32a640824c27493fc91b08704a9f48973b90a26a14c5d40409091529710a73a61dc0526

Download Submit