hxxps://paypalobjects[.]com/digitalassets/c/system-triggered-email/n/layout/images/quantum_leap/footer-social-icons_linkedin[.]png

Analysis

max time kernel
45s
max time network
34s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09-12-2024 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://paypalobjects.com/digitalassets/c/system-triggered-email/n/layout/images/quantum_leap/footer-social-icons_linkedin.png

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133782273642131311"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
272	chrome.exe
272	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
272	chrome.exe
272	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe
Token: SeShutdownPrivilege	272	chrome.exe
Token: SeCreatePagefilePrivilege	272	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe
272	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 320	272	chrome.exe	81
PID 272 wrote to memory of 320	272	chrome.exe	81
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 4872	272	chrome.exe	82
PID 272 wrote to memory of 1128	272	chrome.exe	83
PID 272 wrote to memory of 1128	272	chrome.exe	83
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84
PID 272 wrote to memory of 4672	272	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://paypalobjects.com/digitalassets/c/system-triggered-email/n/layout/images/quantum_leap/footer-social-icons_linkedin.png
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff979cecc40,0x7ff979cecc4c,0x7ff979cecc58
  2⤵
  PID:320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2024,i,15552001483186454366,2156331228713449307,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1944,i,15552001483186454366,2156331228713449307,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2304,i,15552001483186454366,2156331228713449307,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2316 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,15552001483186454366,2156331228713449307,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,15552001483186454366,2156331228713449307,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4644,i,15552001483186454366,2156331228713449307,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:4832

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
8a0f92e2f0ad0407db14e7b92dc39291

SHA1
39d0abe08952a898683b69eb03a7902bdda65ddd

SHA256
3289cd274889f5661665d5ad7569e8ec6e27c61dc396e922c4175081a3c30cb0

SHA512
c9b892c0f801da283414e63117362dcc2dbeb33650d017fea8830ed747a27229456dd907be48f7030474c56edc80d19ea799f75390d2a1d72fac458f18a56dbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
ea526674a8e2873bdf151ba8dda209d5

SHA1
ff20a4bd1fd6015fe1ca55f9ea07e8e70577ec75

SHA256
895892d4b79e2d6595aed80945cdcfe00f60569dfc0f78bdbd41199ea99d4ad2

SHA512
68b3a30131d3faa8e0e3a1de577d30a152ff301acc4876a06d5c47d7bbd1d253a13149384916f5b8d1b883e9c2f77fbd4534c913b24def6419604e2fe0870f98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e8bfc161f1cd6d68c02c4aa341632ff5

SHA1
499f1ca605e22b3669cb2fdf2a82947149184956

SHA256
6728f862b07d6c7044197e9890621b0f2affd6ec2146c8ee7a25dbc7265cb909

SHA512
fdf74222fb5661f9ce7d2dd5b82f76bd2235648c6db570c77321d102180552f76857bbbd18b1334ed62ff541a7d0476cf95803c8fd82426cceb2492b45197fd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
488e327a43b52e3610ac45a5cc0ef596

SHA1
902709b82971e87e86bb10dbec44facbe6662357

SHA256
530c47c0fad51f16776fc732ef2621ab82932488c64366f1c74d80c22dde6879

SHA512
a164430f4a97a47425a273eb09b17e7aa1df98b7b07318962df897257102add8c4137faa71bd60637adbe9ec4618914b6ad48d58ae863293dced3f4b00362c11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
eb0269335f176ea8942e6566bc155331

SHA1
e12bc7b82fbe807f0d7768505afb9e2de62a0917

SHA256
5e43b2f22043594c6fab4881ae8e0305d03d1f41859705c8f59184a650ba5f00

SHA512
5064b5838c63977175e5c7a4d4b49625f394b9efa26c5ae4f68ef9089f5f2e279f8f2904864694d918dbc05caed70fb5ae45976917f58533f9938d7390acf68d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
1b66472457287b7c0c28552bd785698c

SHA1
510baaca309bf3d3f70f3dd4327c93bc7930260e

SHA256
398ce16b7e8bd63893851e47e48e4e934f198e02716b311c9b5e90c7cf661eb3

SHA512
6b6c1b4b80921282055bacae060490322c408d0979de0bfccd66720af8ea3206a40cf695f5ff67908a08225096f608b42866c2c729bd9d4968ad29c41a81f4f6

Download Submit