Analysis

  • max time kernel
    1201s
  • max time network
    1088s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2023, 03:47

General

  • Target

    https://click.smartsheet.com/f/app/qxlsCRIAhF6I5wvqxuUhqA~~/AARF7wA~/RgRl7X-6P0UOY29udGFpbmVyLWxpbmtEW2h0dHBzOi8vYXBwLnNtYXJ0c2hlZXQuY29tL2IvYXBwcm92YWxyZXF1ZXN0P3V4PW9rYnJXWW92ZUE3d2l2SUw4bWxRVEt2eUZxQjVLQ2RvQ0JiMjQyTVRCWDBXA3NwY0IKZAq6-gpkAcR_oVIaYXNobGV5aG93ZWxsQHFhbnRhcy5jb20uYXVYBAAAAAA~

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://click.smartsheet.com/f/app/qxlsCRIAhF6I5wvqxuUhqA~~/AARF7wA~/RgRl7X-6P0UOY29udGFpbmVyLWxpbmtEW2h0dHBzOi8vYXBwLnNtYXJ0c2hlZXQuY29tL2IvYXBwcm92YWxyZXF1ZXN0P3V4PW9rYnJXWW92ZUE3d2l2SUw4bWxRVEt2eUZxQjVLQ2RvQ0JiMjQyTVRCWDBXA3NwY0IKZAq6-gpkAcR_oVIaYXNobGV5aG93ZWxsQHFhbnRhcy5jb20uYXVYBAAAAAA~
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff817a99758,0x7ff817a99768,0x7ff817a99778
      2⤵
        PID:2072
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:2
        2⤵
          PID:3540
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:8
          2⤵
            PID:2116
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:8
            2⤵
              PID:3160
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:1
              2⤵
                PID:1728
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:1
                2⤵
                  PID:2096
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:8
                  2⤵
                    PID:2788
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5336 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:8
                    2⤵
                      PID:2112
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:8
                      2⤵
                        PID:4168
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3852
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:968

                      Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              96B

                              MD5

                              a04f4a8e7267add5e1cdebbbd2896d1b

                              SHA1

                              669c0218c6e50e050e8a4072277691bc4d84b58f

                              SHA256

                              5d2235e39a33499fe8b813021b3fbb7e29f894656d4f86b165cc6fa375480f82

                              SHA512

                              6af861db6a0c582c14087c21be816863e10698c23a2597e540ee734d7c7e62dcfd6c9cd2c14c21c3556f6f8c8b5d928b4dd3f96a8f85f8e2b180114030fd9dcd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              0f78844851936790ca1afbdb9375b5df

                              SHA1

                              87d9dbe87123e4a3635474f505dccd9141425509

                              SHA256

                              4cc1ccd036c07eb9391d88630fc248fbd03cddf6b8e7a960e682f5e150b4bb14

                              SHA512

                              94cc66f7141cfe97f416fcca2f571a604ce7015cf420c7e1904d34d41aaced1fd5550539e71d81882873525822c2774f527905e145c28809fef535746e4e21c3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              705B

                              MD5

                              3e51b9eaed5f5e0dec84119b85bbceca

                              SHA1

                              c011928271bee4012b8fe4476ade30247d510fac

                              SHA256

                              294f6126ba8b4a9eeda0879a59d5ccbd134f4454f2038c000f032bdca52f9de8

                              SHA512

                              b831d007c2f41bd5890c6e0cbd01a7fe0d298ede5417b5a139d18db297d01cc6bc5c74dfb0367535385c542f36e2c3ed157f1ca4ba58681d46f669014f47fde1

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              d17bb8fb5c47390e0b24cef6e134d4ac

                              SHA1

                              f05cf9fac5b8afe1fea9cae2f0493db25f39a889

                              SHA256

                              d206049969e1fdce86444831668487765a22c11c14a0428699879f1f10987d40

                              SHA512

                              94eee075513994b12afd9b1cddd8a44112d37c577c45be48031ec2a9b439f19a820faecc45fd1477959759c5a564815bce997d305061d4a95c4b2dfa66a61a07

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              66113c072fd3c24cf97a75a0f8323e96

                              SHA1

                              6dfa0eb5ba657a3749a929c61d4bcdff92522581

                              SHA256

                              0503be83dbf28312d94a82d75d81f1f88c9fe7986d192085ffe75733aeba608a

                              SHA512

                              c99e8944a3b91ecd0b07510f2b4b731916247c0e5d624480facde32b48ce03d5da27b856f9fd26d09c16e91bcbd1ba7348bf14f989766a02e27f860d43b910cb

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              15KB

                              MD5

                              67021b527b3b6152c97b9672b28dd839

                              SHA1

                              cd050730bf7c96ab9fe3cbcbc2e74865864a1043

                              SHA256

                              5097229dfd62fbb4f0dae13cb3649803587196a7bea005a56eea20614717afaf

                              SHA512

                              5e6ba607733a0a8b40e24b4a1618e85fe63c93591f9981a675d9e43a6f702bbe02377f84d6a588bbf51dee036b974d0e93255316ed8b9316aae6c32665a3727d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              143KB

                              MD5

                              ee61738ecd8b0d1e311232263e2dfe90

                              SHA1

                              800b23547eb133b565a60fbb64cbcb1d6ae3fad7

                              SHA256

                              c357b0c91e01bb4618fbb043e3055b33ca27e7f8816aa9dc152d780651ef85eb

                              SHA512

                              85ee18623067a81e59652e2bce2d0667d86715af018f69b6b16562e2bcd17a8679dd7458d54bde9336d84f650ccc52738230b34e65326dffd74e63f1c3a5c040

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd