Analysis

  • max time kernel
    109s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2023, 22:50

General

  • Target

    email-html-2.html

  • Size

    4KB

  • MD5

    f3e6de185124092cb2a7336601842b6d

  • SHA1

    35405ba0a6637cab4569a3e8c56292d4027b6c0e

  • SHA256

    331a7d82d4234bc7501a41a94e005438d2860555a059c07d3df7ec4555e94162

  • SHA512

    068b9cc2b8919a2a35de058325f34abb6260a419406c9c240ed6a18d3c8c845eed66cc715c47e8919a13019dd31d36569d651ef7d4844986ccbd526324eacb47

  • SSDEEP

    96:hPGsxhxL+oASpt4zchkGol8pf54psl0fLCwmUnsDfLflpkl9lMsDfLfsOfsw:8sxhxL+oASrychkGVf54pGamSnsDlpu/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\email-html-2.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffff7219758,0x7ffff7219768,0x7ffff7219778
      2⤵
        PID:1164
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:2
        2⤵
          PID:4188
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:8
          2⤵
            PID:1108
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:8
            2⤵
              PID:3668
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:1
              2⤵
                PID:2576
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:1
                2⤵
                  PID:2540
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:8
                  2⤵
                    PID:3204
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4928 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:8
                    2⤵
                      PID:4812
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:8
                      2⤵
                        PID:5032
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4908 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:1
                        2⤵
                          PID:380
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3792 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:1
                          2⤵
                            PID:1176
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2840 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:1
                            2⤵
                              PID:3400
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:5020

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              840B

                              MD5

                              f7dce1aff8e3fbad7f2ffe834ef1ab32

                              SHA1

                              266483bf19f2debbe63251f564f062f5f8762414

                              SHA256

                              9450e2b805aa28361903e16a836acbb4ea8b4ef950988355afa63c6af03ec336

                              SHA512

                              c290628af4ad5d9342db1d92c08ccf77bb049f704e4c952f0db37320674158f8e73e07b16004fd415aefb8946aa1f210546cab5992b9c854f0e4521146e222cd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              1bbc5c47298c0394346c606a3c00ab97

                              SHA1

                              7a5acf23592c00d45aef267c2bde9c1d334a19e5

                              SHA256

                              5a98d88f26a9d994731f17d9fb351d7c7d4749f09c498adb495aa6430da1cdd6

                              SHA512

                              d42d447e24c38057b2956305dba9847870e183ac71f6a11314c6c01282602861e14df20adcb2f9daca3976ef7b18e8d7e23d6c6a46b06025e3e3055b966034aa

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              ada12985826367a79603863166f9107c

                              SHA1

                              555b72cd7fa51d2ce4e7fbdc5e2ddde044feeebf

                              SHA256

                              0edf2e4cc97797860fd07771bb24a03bb6f57a8da47becba0184eaa0136b3d6b

                              SHA512

                              2e3a7d7c66ec09db00a0c2305f91dbb28c62bc3bca53cfcbf2e517ea716f946983d78b5deea0c662329b0a2da350744195f370f3b90746c90d24d93a2fa23186

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              e3d3169452b5744a17f3656373caa6df

                              SHA1

                              1875c4226b18a8995cf3687df08efe560821f4cb

                              SHA256

                              d7ccd4184c6220a4254b2add5f91e6de942fef8f7e52313eda391b85f468b1cb

                              SHA512

                              a676fefea10c0dab201a426b7c52c332f7e9ca42a802c59a02cc31cc3a3185c539d28ca7f2347062e7c04e5163581514f3cc94d6402ab031cae5275ee3298bbb

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              79c3a42d21efabf7684ed9a0c04f599f

                              SHA1

                              670c46743635180be5eee9d14b295d762a7c2285

                              SHA256

                              3002f531f5fe23ddc344565b0f05fca25a61633888f8381c8be45e06a474806d

                              SHA512

                              9529c1dbf28822d2f97a1c93a3da6f8146e248ed2ed7ae319f348407c42abdfead7ea7c98617c96905d663a22ad4c0fc6f91344ee6d5421676c820202d383aa5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              4026caf3b875abc6b4b3d38427f108b4

                              SHA1

                              b560fe3440850cd8318f4f841db1319e4d616360

                              SHA256

                              8389e902e9840e7d53756f3f1c2b9476f4ddd669eb175acbc4c9a067903dab6d

                              SHA512

                              1f2eced03d9cbfd167bf0505727cac56f428d8d40b89f88ff43039868625b0bcfedc031ebe2952443fb0affc54726210127bc9fd7a8daf102e819305d82b1e9b

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              15KB

                              MD5

                              9412b0d52fed597e010ec851eeee2373

                              SHA1

                              86adfca1ca04cc9e53c625ae618682b68a30520b

                              SHA256

                              3e510c66593b1e6c8a330c60ccd6b12e109c12f8afc42566719541fbaf7fcb5a

                              SHA512

                              14603ee1acd6f2aea1b71bad2a584f9c1ee2fe4ca03443e1d60c9e7e523e95754d7065c1de24e61a0d634551c7e2ab8e035a4b04375e6ce699a5354f132cb1f7

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              144KB

                              MD5

                              824b89e690a43c3da0256de88c272580

                              SHA1

                              b54dc452e7727dd6f47eca5025896b6d708f948d

                              SHA256

                              73f7707d5eed18634f8c096ff8323fcc7dd9acce040594b95d5259956dc2de89

                              SHA512

                              d74fac3ed2a5c2c63ff2ec944277613980494c24d612bb4b4848dfc04c3145010e599a99a0f727bb030a54623499851ab7bf90255394a8180a4b07fc8e02f3e3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd