hxxps://www1[.]cleopatra-slot[.]co[.]uk/index%20(1)[.]html

Resubmissions

02-07-2024 01:40

240702-b3wvesvgqr 1

02-07-2024 01:36

240702-b1g89a1grc 10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www1.cleopatra-slot.co.uk/index%20(1).html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133643580568747628"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

5036 chrome.exe
5036 chrome.exe
4580 chrome.exe
4580 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

5036 chrome.exe
5036 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 5036 wrote to memory of 3660	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3660	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 3864	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 372	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 372	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe
PID 5036 wrote to memory of 2008	5036	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www1.cleopatra-slot.co.uk/index%20(1).html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb60b4ab58,0x7ffb60b4ab68,0x7ffb60b4ab78
2⤵
PID:3660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1896,i,2178905963890309656,11772681488047352133,131072 /prefetch:2
2⤵
PID:3864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1896,i,2178905963890309656,11772681488047352133,131072 /prefetch:8
2⤵
PID:372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2076 --field-trial-handle=1896,i,2178905963890309656,11772681488047352133,131072 /prefetch:8
2⤵
PID:2008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1896,i,2178905963890309656,11772681488047352133,131072 /prefetch:1
2⤵
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1896,i,2178905963890309656,11772681488047352133,131072 /prefetch:1
2⤵
PID:5076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 --field-trial-handle=1896,i,2178905963890309656,11772681488047352133,131072 /prefetch:8
2⤵
PID:3944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 --field-trial-handle=1896,i,2178905963890309656,11772681488047352133,131072 /prefetch:8
2⤵
PID:752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1896,i,2178905963890309656,11772681488047352133,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4352

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
003addd3bd9b92bede6b36ec3fb44a90

SHA1
37cfece5e69ddf730ce49510372cffb8069d1130

SHA256
7834441c0f1ae14c12344152ab1ad34219b9af8ad8c901e292931081dfe4e407

SHA512
54ad36c7f18583f0729b06f05e0a7412ac9be36c1f67b1d615753cc42282c4a935fd8693a9f1fbdc12cf13d778a986df3d927fc09e4c4f129d2e310714c9280e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
3e5db9f6db8ecab13293162a91c3c400

SHA1
b79fa2dcf20bb3dbd341f5959adf7a953f174552

SHA256
86332fe5e3f330ddda88651b9d38344e8850ce367144539a509f90f3286e7d7c

SHA512
649d84469e36a2d7c80d0f294d5dc77fc5f02ac846e8c008c2e149db4d1fd39ff015cf5b7cd66278ddd184b5760c9d3b055ef6230471fad8c46c50aa1186c3e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
524B

MD5
f8140277dce1bf578db45d21b9a830f0

SHA1
d25e0ea540e2144feb102d6566f926ac7f891c3e

SHA256
90cc1883e76c39cb8f2f33705d50ab9ca840848a03e464ebfb28899eafebc15e

SHA512
07137abedf22cf3e170e69b66fe245b357ec48eca4dbebaec50393514c329b4a005b2bbb006106c07014ecf52cc792d20337d30de67b979bbfd3d17434e44b2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
3260bf083293376e16511212d3f52e60

SHA1
79ef8fa3f8045e7b7b3fbc7605309401b9a16cbf

SHA256
02549de29d9a12f7ef34947356a3c18a6a031bb5e284389f6d230b0843090b6a

SHA512
38af3ba85d322aa2dd25c975e48f004e76f1b5895556b56c0c3bc493cee9aa936a375333456989c9be496da305917d5edd887fe8c75a31e1f69f227395510dc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
fea98c696b386c0290bb1893611fc26e

SHA1
eccbf497560fd3b10ed4125ed0cc939f23d92c05

SHA256
fbfe02185d51e03431526869125a7580d01326bc3e621393153c0d40e91a486e

SHA512
38e213e0f55bf1ce4d4fd13f97b3cb31264317348a4a3cc39b33505186a4675c287eccbda5c2ceddefeb5b269b56cda35ec578d570fb1da1f9cf7f3b2d01187a

Download Submit
\??\pipe\crashpad_5036_CBGUOZIKIBITJWLP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit