hxxps://www[.]attemplate[.]com/nam/60436191-a420-448f-b3e5-9d00da0b2a58/888e3a59-f493-4f38-8cfb-1d9caa50d56a/84ea2a39-234c-44a6-bf0c-e54d546b5053/login?id=VndzV05TNFRJS2h1dkZoSVR6VlF3b3JEZzJ3RkhUamJMdmRLRkhSM281MmdOc2NqQjE3Q09Ob25SOS9nQnh1Nk5DbGlJM1JBYlJ4bGlCTkx0Y1F4NFVNRGVKb3ZONjVVMFpCTTRValdyVFRHLzJiUFJ3dGRqQWxJVjBFdlNNcmUrOER5WUFYV1lTVCtUdWFhR1pFREFsdlpVSDNZQkxZbEZwa0lsV1g3NW9lZTlUeEM5Qjk3aTZUWThmMEt1Y3g2QVRXdjF1ZlA4bGNoVzdDNUZ1em5PRzFFcDlCT21pWjdncGk4Wkd3L2RmZ1pqbVhFRERjODQybllLd0lzT1Eranl4RStBaUQveEJNQ1pGVFQyd2xNc1cxRVdOUk5IdVJBQ2gzTHF4MVMyNTlzbDdLbjZndVVPdEpJTEYwT3lPNFdTUlFrT3pEZnZvVVdveXRzU3NvNkNHQ2FjVXE3bnRma3JaSHJPYjhTeFNrKzFELzRpUXpzOHVzUmJ1aVpiNk5aTEd4MDhpSDl3MlA2RXY2Ull4dzRKZVZLL3ltUGQ1dWt5Z1RGNXRtdDk2UT0

Analysis

max time kernel
19s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.attemplate.com/nam/60436191-a420-448f-b3e5-9d00da0b2a58/888e3a59-f493-4f38-8cfb-1d9caa50d56a/84ea2a39-234c-44a6-bf0c-e54d546b5053/login?id=VndzV05TNFRJS2h1dkZoSVR6VlF3b3JEZzJ3RkhUamJMdmRLRkhSM281MmdOc2NqQjE3Q09Ob25SOS9nQnh1Nk5DbGlJM1JBYlJ4bGlCTkx0Y1F4NFVNRGVKb3ZONjVVMFpCTTRValdyVFRHLzJiUFJ3dGRqQWxJVjBFdlNNcmUrOER5WUFYV1lTVCtUdWFhR1pFREFsdlpVSDNZQkxZbEZwa0lsV1g3NW9lZTlUeEM5Qjk3aTZUWThmMEt1Y3g2QVRXdjF1ZlA4bGNoVzdDNUZ1em5PRzFFcDlCT21pWjdncGk4Wkd3L2RmZ1pqbVhFRERjODQybllLd0lzT1Eranl4RStBaUQveEJNQ1pGVFQyd2xNc1cxRVdOUk5IdVJBQ2gzTHF4MVMyNTlzbDdLbjZndVVPdEpJTEYwT3lPNFdTUlFrT3pEZnZvVVdveXRzU3NvNkNHQ2FjVXE3bnRma3JaSHJPYjhTeFNrKzFELzRpUXpzOHVzUmJ1aVpiNk5aTEd4MDhpSDl3MlA2RXY2Ull4dzRKZVZLL3ltUGQ1dWt5Z1RGNXRtdDk2UT0

Score

10^/10

microsoft phishing product:outlook

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637989619398729"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3768 chrome.exe
3768 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

3768 chrome.exe
3768 chrome.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3768 wrote to memory of 4300	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4300	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 4336	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 5104	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 5104	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe
PID 3768 wrote to memory of 224	3768	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.attemplate.com/nam/60436191-a420-448f-b3e5-9d00da0b2a58/888e3a59-f493-4f38-8cfb-1d9caa50d56a/84ea2a39-234c-44a6-bf0c-e54d546b5053/login?id=VndzV05TNFRJS2h1dkZoSVR6VlF3b3JEZzJ3RkhUamJMdmRLRkhSM281MmdOc2NqQjE3Q09Ob25SOS9nQnh1Nk5DbGlJM1JBYlJ4bGlCTkx0Y1F4NFVNRGVKb3ZONjVVMFpCTTRValdyVFRHLzJiUFJ3dGRqQWxJVjBFdlNNcmUrOER5WUFYV1lTVCtUdWFhR1pFREFsdlpVSDNZQkxZbEZwa0lsV1g3NW9lZTlUeEM5Qjk3aTZUWThmMEt1Y3g2QVRXdjF1ZlA4bGNoVzdDNUZ1em5PRzFFcDlCT21pWjdncGk4Wkd3L2RmZ1pqbVhFRERjODQybllLd0lzT1Eranl4RStBaUQveEJNQ1pGVFQyd2xNc1cxRVdOUk5IdVJBQ2gzTHF4MVMyNTlzbDdLbjZndVVPdEpJTEYwT3lPNFdTUlFrT3pEZnZvVVdveXRzU3NvNkNHQ2FjVXE3bnRma3JaSHJPYjhTeFNrKzFELzRpUXpzOHVzUmJ1aVpiNk5aTEd4MDhpSDl3MlA2RXY2Ull4dzRKZVZLL3ltUGQ1dWt5Z1RGNXRtdDk2UT0
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e816ab58,0x7ff8e816ab68,0x7ff8e816ab78
2⤵
PID:4300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1764,i,5449815666575423095,3910911218027860118,131072 /prefetch:2
2⤵
PID:4336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1764,i,5449815666575423095,3910911218027860118,131072 /prefetch:8
2⤵
PID:5104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1764,i,5449815666575423095,3910911218027860118,131072 /prefetch:8
2⤵
PID:224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1764,i,5449815666575423095,3910911218027860118,131072 /prefetch:1
2⤵
PID:3088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1764,i,5449815666575423095,3910911218027860118,131072 /prefetch:1
2⤵
PID:944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4364 --field-trial-handle=1764,i,5449815666575423095,3910911218027860118,131072 /prefetch:8
2⤵
PID:516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=1764,i,5449815666575423095,3910911218027860118,131072 /prefetch:8
2⤵
PID:2364

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1304,i,8660989700097327804,17931739887231169645,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:8
1⤵
PID:3052

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
524B

MD5
f7b1b99021bee72e20033b47c7da4d00

SHA1
63f36106eba441592f3220e3ec72b9d0d9c0dab5

SHA256
2b3b888d20cdccb9e939f26d0dc8dcbc92c7381fcbe4585c34c9204e4c975099

SHA512
3e374ce96581348ac51bba0aae6374d3aa54ef005d08b768c4a12af418818989275915bcb3161d61f640ec0138cdad21fa56b7bb3e004e8c03b70200608868af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
85cc8fa40ea9ec8bbb7555e8c14b32d2

SHA1
bb787b3ae50315037f8fa53a5f623ca26a48f428

SHA256
1f7860ea561244091258d23471f88a6658ec14cb3bbbb82be39b9805ef747678

SHA512
2381d719e885fc33b4252fc4f052ac541c8e6ba59f0c5beddb2f6d7ef143105081280f812d80902f7cf4048d4fca41d042b4f42725a9948c50069e32f6056a30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
db9ee8b4238e2fc93521674adf64e1e4

SHA1
b61a3f8c1e698731171d385a092d2e7457ef746d

SHA256
6b487d7628a8a3bf9ae2c3dc3efbe2ae40d9c63dfc95dc07682ec266d895d81c

SHA512
dae7a6056c8a093e54dc35f7c9496eb03b0497c97798f140a9a1ea641a7ffcc886615470c3e651ce354780d647797a8393cef9a991dbd424b80945f421348bc9

Download Submit
\??\pipe\crashpad_3768_ZSRSQBKSRWKQAWOS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit