hxxps://bbjystwi[.]r[.]us-west-2[.]awstrack[.]me/L0/https[:]%2F%2Fscla[.]iltia[.]org%2Fl%2FAaxySRGat3oDqCqo5ns7Vw%2FvLDAnd4JFgmx892tKqUcgFPw%2FYRLZY03XwW9jZOCMJjPVGg/1/010101927ae16b49-3cd0272f-b267-4ddd-bba0-02b3faccc2a2-000000/Z4_T-NXrhLyikP-DE-eNCUjBxKw=396

Analysis

max time kernel
18s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bbjystwi.r.us-west-2.awstrack.me/L0/https:%2F%2Fscla.iltia.org%2Fl%2FAaxySRGat3oDqCqo5ns7Vw%2FvLDAnd4JFgmx892tKqUcgFPw%2FYRLZY03XwW9jZOCMJjPVGg/1/010101927ae16b49-3cd0272f-b267-4ddd-bba0-02b3faccc2a2-000000/Z4_T-NXrhLyikP-DE-eNCUjBxKw=396

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133733879517977069"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
740	chrome.exe
740	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
740	chrome.exe
740	chrome.exe
740	chrome.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 2212	740	chrome.exe	83
PID 740 wrote to memory of 2212	740	chrome.exe	83
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 3924	740	chrome.exe	84
PID 740 wrote to memory of 348	740	chrome.exe	85
PID 740 wrote to memory of 348	740	chrome.exe	85
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86
PID 740 wrote to memory of 4004	740	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bbjystwi.r.us-west-2.awstrack.me/L0/https:%2F%2Fscla.iltia.org%2Fl%2FAaxySRGat3oDqCqo5ns7Vw%2FvLDAnd4JFgmx892tKqUcgFPw%2FYRLZY03XwW9jZOCMJjPVGg/1/010101927ae16b49-3cd0272f-b267-4ddd-bba0-02b3faccc2a2-000000/Z4_T-NXrhLyikP-DE-eNCUjBxKw=396
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe76eecc40,0x7ffe76eecc4c,0x7ffe76eecc58
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1852,i,15616140862962446160,5384074856016210879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2160,i,15616140862962446160,5384074856016210879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  PID:348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1856,i,15616140862962446160,5384074856016210879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,15616140862962446160,5384074856016210879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,15616140862962446160,5384074856016210879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4368,i,15616140862962446160,5384074856016210879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4976,i,15616140862962446160,5384074856016210879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:2680

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b4155a892ddfc3f4c013dae2534f8c11

SHA1
b40e476fc8c2e0eac316333b1e44b15fe1a92746

SHA256
0241f69fc24bd797a1c4ac0122639762cf9d77da5dff26f468043a9ee1325415

SHA512
83f7310a91dd99f81755e0ccbaa4da8f9df9d43ae30ed3a05b5e71516b88f9cfd860d207966d93e1880faad41a2d5320886e6173ba7b5473960f6442d70c055f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a31280304f4bab11c93da281024aa859

SHA1
3f290b1af3ae77678075112fa541cf8437dfc433

SHA256
19e97a5f3b201138f854c116fdb9145f147a2679521f1d52d22cc25be1827671

SHA512
16026d730840b9c3ab6e87620fde1f7e19310126f3dcdc03b0e51c74d46985af0ef0e795693b65bacfeb2006d9c802322b92cccac894afaff3d4f96f46fa4e2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d3a9a6aa342f71d084b89dc981c89ded

SHA1
c5f67f4ff4ccf3fe6fd839f9df4f4d3eb9da2e9c

SHA256
3e6e1ee0c88ee586819aef01ebaaa616ace97c445342e68473ce8f1f85cc9b5a

SHA512
69b71067088f59fb0f2a89c722ef26334cac4c68f4133b29d0ed38d4fe53a82eee96c98cd7e8d3cdbf18fee81ccfa0a5cf95ad942f1f52948142ee8c72759619

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
058c637838a191f11a727ec4aea14f48

SHA1
7e9ff5f82d2ddfbfd62eb157e1922894fa63c51f

SHA256
f4c8a8be597781b7027a5699b770b02f45a4a5cd187250b9ed7ca999c3fb022a

SHA512
6f7a2c0b024790e4f6efd2ff17040dcaa0bc76b9f5f8f3d2b17761ff84c7125676395478655d347dac67f1f3e1429abb31ebc30fde1999c768c2dfcdc22da7d9

Download Submit