hxxps://t[.]attractive-snail[.]com/+?y=49ii4eh26orj6oj1ckr30p9m74ojid1g60o32pb4chhmcc92

Analysis

max time kernel
17s
max time network
17s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-11-2024 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.attractive-snail.com/+?y=49ii4eh26orj6oj1ckr30p9m74ojid1g60o32pb4chhmcc92

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133766649004145095"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2032	2948	chrome.exe	79
PID 2948 wrote to memory of 2032	2948	chrome.exe	79
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 4320	2948	chrome.exe	80
PID 2948 wrote to memory of 8	2948	chrome.exe	81
PID 2948 wrote to memory of 8	2948	chrome.exe	81
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82
PID 2948 wrote to memory of 5048	2948	chrome.exe	82

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.attractive-snail.com/+?y=49ii4eh26orj6oj1ckr30p9m74ojid1g60o32pb4chhmcc92
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa6d1cc40,0x7ffaa6d1cc4c,0x7ffaa6d1cc58
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1560,i,12646915792423404073,6513002178257664068,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1540 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1632,i,12646915792423404073,6513002178257664068,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,12646915792423404073,6513002178257664068,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,12646915792423404073,6513002178257664068,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,12646915792423404073,6513002178257664068,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,12646915792423404073,6513002178257664068,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3452,i,12646915792423404073,6513002178257664068,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:132

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
dfec5384e5b5c7c95964618dfe0b3fee

SHA1
b2fe8d6bcf0463d00044a563dab488e86168b52f

SHA256
080420068daf8c0277e54407028640e7dd73d7dbe088ea96a464077199ad2df8

SHA512
2584cb2d374747d68d2c3c95e8bf27b749df80b0a5a0284f970ef83695e39b14239f6268e46a409d40f6881dcaec4e91c3c41a8b908738c756222d3fa57847e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
f29a5474f535f20a8097949ad622a347

SHA1
cdd175158866b66250a66e9e0719d4550e9be1c1

SHA256
24390247977481f183ed7c50554a652a6f3f7e058fe8562c348d2f3e3ac8aa2e

SHA512
5b63abed306e9edc111b0be9799dc7e1dce0203b71013ebf0e456768ca489e6d292e78ab4fcb6e82ce1587b491e3f1fe7ab3b9ed9faab9e4766369a68f5ad02f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e2138519f4dfb9982e2de6a77a2cec0f

SHA1
208976c8a377b110ca9dc23da346cd4b245cd9eb

SHA256
e672a6960ee15e65f81592e167b7368c0d3863a54fee6f2ed78e9e2ff8ce1bcc

SHA512
60e742908580e35749b95b58ce8edffeae2c9f3890865fa8fe9a0c09ac39647133e00496220b404d0fb021945922d3d477f25c737ae95677b8b79aa36d77881d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
77423790e2b4ca902238569b695b9750

SHA1
511fb126c5d712e6850f59df24b1651f9233d961

SHA256
9d977b413804961b3c1682eb4a54ce13543ec012b39dcbbb3fb32de917b5e40a

SHA512
ad4791f04f1e411c5f756355ddf7380682b392b0c9ecb50a497473278077cca09369874f608f931c53ccae5aa279b28331e6b12c89e836dd7568ca0846d47490

Download Submit