Resubmissions

24-03-2023 03:50

230324-eea5laca49 1

24-03-2023 03:42

230324-d9r6xsea61 1

24-03-2023 03:41

230324-d8x1saca24 1

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 03:50

General

  • Target

    ATT00012002.htm

  • Size

    210B

  • MD5

    ec648e280ee68a08b16602d335687c33

  • SHA1

    424af13b5e65931b6897386f95343e8693b7099f

  • SHA256

    bd27523d0e5b852f6a4fa1d7a9163ad361adbfb0b95541c7370d7f4e9b486cf3

  • SHA512

    038eb9622dfba3850d31178c1bbdd7e611a4281f53dd0fb39cc80132140df83887e42b617f636a2e07a77af5f3dc22742c4adf3d282a551d83a87545d9fed534

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\ATT00012002.htm
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:64
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd72bd9758,0x7ffd72bd9768,0x7ffd72bd9778
      2⤵
        PID:60
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:2
        2⤵
          PID:4072
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:8
          2⤵
            PID:2688
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:8
            2⤵
              PID:1780
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3148 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:1
              2⤵
                PID:680
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:1
                2⤵
                  PID:4656
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4464 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:1
                  2⤵
                    PID:2968
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4612 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:1
                    2⤵
                      PID:776
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5092 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:1
                      2⤵
                        PID:4540
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5244 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:8
                        2⤵
                          PID:4700
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:8
                          2⤵
                            PID:2092
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:8
                            2⤵
                              PID:4644
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4700 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:1
                              2⤵
                                PID:4520
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:1972

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                240B

                                MD5

                                61737e76ed07b554ba5542cb4ac00029

                                SHA1

                                262aa49bd6e84e461f4027057339696fcad8b2f2

                                SHA256

                                6c2ccba39a4f00df76c339a84ca2c4525a88142294caaab1e1b79fb6c696661c

                                SHA512

                                e145cfedb68d4e2487e15130d716259b7a281e05154748d47abf43b394db95dce47cbc80862042e92817a45b1636e0584f7e11c6239ca8c4978b2e516d3f34ee

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                71d3160e05fcce7a3beea2bed4c46a1e

                                SHA1

                                aa6450ba363cf48c51920ab947d77fd5176f0a71

                                SHA256

                                d1e560a79a383836c6e62d8ed791735799ae55963d4e4042da8b3b1d0b6367eb

                                SHA512

                                7f66e70ab8fc3a76f32b579260660d7f2a4c6504e8ac45fc3e6dd59f5a0668d381f168cd2dbaf5db4e24103ccfea4e557e66f7229ebe1688534e807bc0ec0c1d

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                538B

                                MD5

                                bb3eac888522974c774e90d782f39d37

                                SHA1

                                a837a367aba84c04773d9e5830f24c545d9b4083

                                SHA256

                                f2284ae178cdef2e4685facffe8acf04a34059ff9888b5830a2958ca15d4d73d

                                SHA512

                                df3d15da8dd398acd0fdcdd5f2868e4f62a58b66193227ef5afa25b46f859052313a4f3484d74a37e627bb6f1f8c7d18e23d95571fe70c8a80cfee556fa916f7

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                ef3995d8bbc79e41346bd6c20e0f4600

                                SHA1

                                4d897b8f3e594a6103ce1ecef5094281530d0b51

                                SHA256

                                5a6657e1fb81513d2aea8ea5baf40503be7c2f1df15b7a3b3195f80a2b486b6f

                                SHA512

                                bac1f93b714ccab8cf47f74d28210e076c60ede288006f68736b24a91f00d79b3e028d661e566d2edca8ba4c4eb8be1def6a492c22840b2a195d419196a749fd

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                1ce49a68b65df972acfeb3f2f60a8cc2

                                SHA1

                                680ac180b5c700d9a9b6d2e3514beb02cc2d6714

                                SHA256

                                768e33579273ea2b198baa4485604d90b6426e8893244f15ee008f8e610367a2

                                SHA512

                                8ef80b95d5d73c8a5e4e72ab3aa55ed49dc08e3b3f1a70e86537ba380ecc4348fddbe83fd5fbbe63449aba4abce66bb051872de555ee7836dafad0f4364612a0

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                42a9ebda34cd3bdde8ee086fd9ed799d

                                SHA1

                                7dfea13fdd44c13505df51f36c55fda28a5b70e9

                                SHA256

                                6c55bb46ae28f04cc77892f289ab3c483d7f0732db5d8983e612d170ce987f12

                                SHA512

                                2b7a29b22a6867269399b9b08d8588d31ec8f1ac7a2907b5347547dd0b1f5d58ae690229830b57110c8f9c02318ff9558fdc68f51f7a33cd663515575d4d268e

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                Filesize

                                15KB

                                MD5

                                d9c4a6cdd296cea00409b2228a9e0657

                                SHA1

                                ea304b2913110047c050da743f5d099521e6b646

                                SHA256

                                7731b33d501bcd76faf9de6cbea3ef7202b936f79d7565f3feb0c76b6182d5c1

                                SHA512

                                2741e4c6100f5026683bf8855e791d21526023aad27e0f6294171d1ece8146f8814556d11b2d0d28b67a2a0b8e6c62989049301e1e0bcbbea9b8ab3efe179bf6

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                145KB

                                MD5

                                ea671c5dcd181e9ef608374cd94130ab

                                SHA1

                                aa6cceb393b6e8b4b43df3fcee7395fe4214faab

                                SHA256

                                b953eab93e6eed49c741df54eaed1791b49544745fb3727c282506daf28ae3e7

                                SHA512

                                e0d483b61ab226f96ec15280e348276b79271f85e8235ff7fe01304297498f6cd3f5c5d09c9f91a3cc90e40804b5d3526c14879c313d78ef6a0bcd6a1bf4b3d0

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd