hxxps://login[.]weixin[.]qq[.]com/l/waEMXWfsHA==

Analysis

max time kernel
119s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 09:57 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://login.weixin.qq.com/l/waEMXWfsHA==

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133720774751188918"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2924	chrome.exe
2924	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2924	chrome.exe
2924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3864	2924	chrome.exe	82
PID 2924 wrote to memory of 3864	2924	chrome.exe	82
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3328	2924	chrome.exe	83
PID 2924 wrote to memory of 3452	2924	chrome.exe	84
PID 2924 wrote to memory of 3452	2924	chrome.exe	84
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85
PID 2924 wrote to memory of 1236	2924	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://login.weixin.qq.com/l/waEMXWfsHA==
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7afccc40,0x7ffe7afccc4c,0x7ffe7afccc58
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,8058891853801382050,3742275267885633764,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,8058891853801382050,3742275267885633764,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,8058891853801382050,3742275267885633764,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,8058891853801382050,3742275267885633764,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,8058891853801382050,3742275267885633764,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,8058891853801382050,3742275267885633764,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:4864

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1112

Network

DNS

13.86.106.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.86.106.20.in-addr.arpa

IN PTR

Response
DNS

login.weixin.qq.com

chrome.exe

Remote address:

8.8.8.8:53

Request

login.weixin.qq.com

IN A

Response

login.weixin.qq.com

IN CNAME

wx1.qq.com

wx1.qq.com

IN A

43.159.234.18
GET

https://login.weixin.qq.com/static/common/login/images/spacer.gif

chrome.exe

Remote address:

43.159.234.18:443

Request

GET /static/common/login/images/spacer.gif HTTP/1.1
Host: login.weixin.qq.com
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://login.weixin.qq.com/l/waEMXWfsHA==
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Type: image/gif
Last-Modified: Sat, 07 May 2022 07:17:22 GMT
Cache-control: max-age=86400
Content-Length: 43
GET

https://login.weixin.qq.com/l/waEMXWfsHA==

chrome.exe

Remote address:

43.159.234.18:443

Request

GET /l/waEMXWfsHA== HTTP/1.1
Host: login.weixin.qq.com
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 902
GET

https://login.weixin.qq.com/static/common/login/css/confirm_login_webwx.css

chrome.exe

Remote address:

43.159.234.18:443

Request

GET /static/common/login/css/confirm_login_webwx.css HTTP/1.1
Host: login.weixin.qq.com
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: text/css,*/*;q=0.1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: style
Referer: https://login.weixin.qq.com/l/waEMXWfsHA==
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Type: text/css
Last-Modified: Sat, 07 May 2022 07:17:22 GMT
Cache-control: max-age=86400
Content-Length: 4170
GET

https://login.weixin.qq.com/static/common/login/images/icon_login_qrcord_ios7@1x2604f1.png

chrome.exe

Remote address:

43.159.234.18:443

Request

GET /static/common/login/images/icon_login_qrcord_ios7@1x2604f1.png HTTP/1.1
Host: login.weixin.qq.com
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://login.weixin.qq.com/static/common/login/css/confirm_login_webwx.css
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Type: image/png
Last-Modified: Sat, 07 May 2022 07:17:22 GMT
Cache-control: max-age=86400
Content-Length: 4163
GET

https://login.weixin.qq.com/favicon.ico

chrome.exe

Remote address:

43.159.234.18:443

Request

GET /favicon.ico HTTP/1.1
Host: login.weixin.qq.com
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://login.weixin.qq.com/l/waEMXWfsHA==
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, must-revalidate
Set-Cookie: mm_lang=en; Domain=login.weixin.qq.com; Path=/; Expires=Sun, 29-Sep-2024 21:57:55 GMT; Secure
Content-Length: 88058
DNS

42.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

42.169.217.172.in-addr.arpa

IN PTR

Response

42.169.217.172.in-addr.arpa

IN PTR

lhr48s08-in-f101e100net
DNS

18.234.159.43.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.234.159.43.in-addr.arpa

IN PTR

Response
DNS

73.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.159.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

197.87.175.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

197.87.175.4.in-addr.arpa

IN PTR

Response
DNS

18.31.95.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.31.95.13.in-addr.arpa

IN PTR

Response
DNS

83.210.23.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

83.210.23.2.in-addr.arpa

IN PTR

Response

83.210.23.2.in-addr.arpa

IN PTR

a2-23-210-83deploystaticakamaitechnologiescom
DNS

88.210.23.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.210.23.2.in-addr.arpa

IN PTR

Response

88.210.23.2.in-addr.arpa

IN PTR

a2-23-210-88deploystaticakamaitechnologiescom
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response

43.159.234.18:443

https://login.weixin.qq.com/static/common/login/images/spacer.gif

tls, http

chrome.exe

1.7kB
4.8kB
9
9

HTTP Request

GET https://login.weixin.qq.com/static/common/login/images/spacer.gif

HTTP Response

200
43.159.234.18:443

https://login.weixin.qq.com/favicon.ico

tls, http

chrome.exe

5.6kB
105.8kB
50
83

HTTP Request

GET https://login.weixin.qq.com/l/waEMXWfsHA==

HTTP Response

200

HTTP Request

GET https://login.weixin.qq.com/static/common/login/css/confirm_login_webwx.css

HTTP Response

200

HTTP Request

GET https://login.weixin.qq.com/static/common/login/images/icon_login_qrcord_ios7@1x2604f1.png

HTTP Response

200

HTTP Request

GET https://login.weixin.qq.com/favicon.ico

HTTP Response

200
43.159.234.18:443

login.weixin.qq.com

tls

chrome.exe

1.1kB
4.6kB
9
9

8.8.8.8:53

13.86.106.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

13.86.106.20.in-addr.arpa
8.8.8.8:53

login.weixin.qq.com

dns

chrome.exe

65 B
99 B
1
1

DNS Request

login.weixin.qq.com

DNS Response

43.159.234.18
8.8.8.8:53

42.169.217.172.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

42.169.217.172.in-addr.arpa
8.8.8.8:53

18.234.159.43.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

18.234.159.43.in-addr.arpa
8.8.8.8:53

73.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

73.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
224.0.0.251:5353

chrome.exe

204 B
3
8.8.8.8:53

197.87.175.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

197.87.175.4.in-addr.arpa
8.8.8.8:53

18.31.95.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

18.31.95.13.in-addr.arpa
8.8.8.8:53

83.210.23.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

83.210.23.2.in-addr.arpa
8.8.8.8:53

88.210.23.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

88.210.23.2.in-addr.arpa
8.8.8.8:53

19.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
0aabb72f436b5b1b493aedaadb5166cb

SHA1
63321104df032ad766149e34ba378ec5df129b20

SHA256
57893ceef0fc9f4304447d41d3485c39ae32c10a79995b731787025b355ef9ca

SHA512
cfc6432d28d39c2df29a03827060df21e6d4c268318552d17b96e7770842437e862f0736e9dd61d2475115bb3d4ea4fa79bc776235045a75bc7bcd1787fd47dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
961B

MD5
f49c299347730e10cbdba8a166fdec14

SHA1
585f8ce70a986b87fc1c5118f6a0ed457da16260

SHA256
5d8acbd272ff329e47b77cf2846361b157071cf878f965bd7e832b383816c212

SHA512
72feb853716bb95f2383c129dfc2d90d89a1b8816a959f495b3f906d54de4ba5d4307d9706b4d2b0cd90146b90907e50523c69cddd2eec5fef35a68493084211

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
434d0ee15f401df71cf7ce19e7f9d394

SHA1
14b8ae55b3656b69501217a3cf0577de6be3b7e1

SHA256
346c70a3e59a04dee9f169e4c0b3e338f38b6c2b591226a6f0fd888bcd1d3f9b

SHA512
df766dd69fd151e9e4604314195d46905c24338fe807b0241b332ef135c01807755445d5ec8c56615c827391662c229386dfdc67f778511bdea0d8bf3a64ced0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
697b5799a8351f9f645519613ac6d653

SHA1
f4b8e307b71b1a9095cc94361c113b942d04a5d9

SHA256
10084f7d60adc2e1067b11afb175e280c5f585e007b913ea7995af1e4f55ca83

SHA512
2b9f46f951fdf3081ced26fa3c74ad91739f2bc087a6d19058278d50c6f3eb29d83677bc3e79b838e11fc2e893ecfddcce274cf47c71215fe09d5ea17761172b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a49fc5bfca972ea45407bdce4861a57c

SHA1
0d96a60661ced48a809f6b807180a345057838a2

SHA256
a54947257d0320e9234c5e4d98f64183c5aae574f7d119aeb02891c7d44953c4

SHA512
d5bcf600674fe22dda5bb281f5ab64f790b11b5b54230e08abbfdb7bbf0117df1f40c8e7207d7e42761b44aa5419028f8a320fd1ece3c23e33047f8048b24cef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d1365806f25df8e89a2ffa66f4b451e2

SHA1
0209252f57007ec2351a9d97c894fee33e5a121d

SHA256
f7e1aaf1d4ce09d575fc98f7010c13ef149e919e3b3292d3f50cd991ae9ca5cf

SHA512
58ab96dd2e92ab817f76f4d16d7105b98c444304847891dfe7809d25045410681a84865bd907163cc5a0153b01dab054e07e5473453456e20e522a214af890b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
66bd0aaf4778e770723961d14cc408b7

SHA1
9d70602eb390a2e2f1a95979f1ff592f93084582

SHA256
ac13c829aeb0683bf54a17de0dfe364a1a20c999ebe69bf421b9b5ae0f823f8c

SHA512
30f218e31aac8448286830b3aa4467158b45ef7c817c15dc6cf4c54656354cde74d2a53dcae9d84c2524e927ec741635ed2aa6af6feb2855b1d191180c1e374a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
22a53d204dad42caa92898e0e546a909

SHA1
bb1dc5afa845bdbb594329537553535fec760e57

SHA256
ad789c075b2ee4bf0958b64d94751ededb85247a1f3e7c7a9d5fecc6fcf8b341

SHA512
3c4f9e6ec4eaa7f1c964a10bdb61f81ed2bc1445288237d0a8748cb4468bbaaeaf862b599c788553d86e8ef83f3717242d3da681f0c06ac089835da1f40ec470

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\daa62703-2647-4c8d-82a8-2432c8aa6412.tmp

Filesize
9KB

MD5
f539f2b3032ccf370f31d05dd8872902

SHA1
42ed6cb3d5c28e1e49e3dceb5a373889c22acb4e

SHA256
4362bfafe047704e1c637c7de32a4160990910fd78aab6c03b37f4b73535af44

SHA512
9e54313bff6c5bb37049ab4c4269077bfc92bb0f4b1f601bdde6279a2b02cc0b6b2624574135b60b0a94f505cad25a06a1b6c5e1298a17caa1f092349d27cb23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
822fb533be7ae554d9b5b5b931e3bb43

SHA1
605697ad3f50b9da99160bb5f98779513179d5ca

SHA256
0764d948442a67df8aacfcfcd7e0302955c5839be229da2e93ad6f582398701c

SHA512
da36d00b9e0cfdc2dafe63975ae8e8d19e53ed1d117fd418c0ecbc8b7c684f4aefc98de205dab94e970998d6d4bc95f8b455d754f828ce0a64c1a16b901e3000

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
ab4c89a8e2c6dc7c97c7c9a15f1a8a9d

SHA1
c0d7b413c9c802fe6eee730239cc094d54654ab5

SHA256
bd66b98c253b21fdb3f35616672dd6d88eac5e34fc1535fe66d43c820f9c854f

SHA512
1a5729fb78dee3b0c3d015eb81350531fe033c4bbf97c5f960d8ad4c0204b345834eda39515db6612da8f4d42914aafe99c0479bd6eeb57a4822fb8d90c03439

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.