Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 19:52

General

  • Target

    http://dqb6q.anoed.ru

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://dqb6q.anoed.ru
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbf499758,0x7ffbbf499768,0x7ffbbf499778
      2⤵
        PID:3860
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1820,i,4611575254390830557,1312477215860923295,131072 /prefetch:2
        2⤵
          PID:4524
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1820,i,4611575254390830557,1312477215860923295,131072 /prefetch:8
          2⤵
            PID:3300
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1820,i,4611575254390830557,1312477215860923295,131072 /prefetch:8
            2⤵
              PID:5116
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1820,i,4611575254390830557,1312477215860923295,131072 /prefetch:1
              2⤵
                PID:4376
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1820,i,4611575254390830557,1312477215860923295,131072 /prefetch:1
                2⤵
                  PID:3696
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4652 --field-trial-handle=1820,i,4611575254390830557,1312477215860923295,131072 /prefetch:1
                  2⤵
                    PID:4640
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5116 --field-trial-handle=1820,i,4611575254390830557,1312477215860923295,131072 /prefetch:8
                    2⤵
                      PID:5076
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1820,i,4611575254390830557,1312477215860923295,131072 /prefetch:8
                      2⤵
                        PID:4204
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1820,i,4611575254390830557,1312477215860923295,131072 /prefetch:8
                        2⤵
                          PID:3544
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 --field-trial-handle=1820,i,4611575254390830557,1312477215860923295,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1052
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:2824

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Discovery

                        Query Registry

                        1
                        T1012

                        System Information Discovery

                        1
                        T1082

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                          Filesize

                          312B

                          MD5

                          4e56afab51bc2134d7e3ed722421dbc4

                          SHA1

                          fca9e853aa82f550a9a5a6fb467ac0d47f34d518

                          SHA256

                          3a5e6e98ad93760976f0cdcaac03c9d6f16be9343cbdd809aea22cb3935433df

                          SHA512

                          133cb6f4270ce484d8e2941740ff2fe4bf23a3da34ac94a0ce92f87f8126ff77d2665d8b635b46b1a5ba0acb63a855454ab9e4c4174a7cbb018f391c4c6cdf60

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                          Filesize

                          216B

                          MD5

                          d36fa1b18fdbfdf6ce48a00b24c502c0

                          SHA1

                          3f58a2cfb83891f62b8aa9585529addb693bf28e

                          SHA256

                          27d52e93eb5b46ef268632edbd468448bb3ea962681709985fc016cf2ba2f6d7

                          SHA512

                          36671daaf134715205d76360d3d190d598092a826a282b8cabcc4146149a506930528585c7db27d2f577814b286c7c1ea80d9f0213c4e64f0fb6028b19377b65

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                          Filesize

                          1KB

                          MD5

                          6f455bf81e52af0c995694d59d4d59b2

                          SHA1

                          a272f0323c6613abcfa1ad7f38ca2ecf3ecf4a50

                          SHA256

                          9bb98d0239b81e107e69e883d02cf80680e4eefe264b79ac4485e5a82c180f1d

                          SHA512

                          bd60c3da8298850aa1c680c86acff0941def0d72e4ae46de426fbfe68d5b8290733500f04defbd11b10a2597055b67532891cc2568c37873d8e5c8e0f7ffb0db

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                          Filesize

                          6KB

                          MD5

                          9f7f4254df23838d2a12c75aa9a283d1

                          SHA1

                          def0005de834592ef69ae367016d959e3f7b5b08

                          SHA256

                          914ee1e82d2ddd8ae1f8e72827f58ab6a9663b68e74a0edeea8a34e7ee6bc093

                          SHA512

                          be06a97057f30bc7cc7797bf7c19f94ceb0052701fc45dd73e54df1202002e7f5dfdcdb2b8e162411d3207d1f9bdb7007ced92e41154721425ac6243fa61669c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                          Filesize

                          6KB

                          MD5

                          a8d38065ad9ae3d2c08874aebcd4c335

                          SHA1

                          4cbdb58c8ce3a976657360473d19718ada155b1d

                          SHA256

                          ce70ee700109a44c821fab3fd0973b6160bcd425aff8e054601ec6966f4b2071

                          SHA512

                          fdc14593b02345e7bbe71a79034bf3901a9e772d072a444e1ea714475e0ad2ad654d903bf0b69488ce9904c1b3c8992c2edac3d499130b9e51a16b3b2b5c3833

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                          Filesize

                          6KB

                          MD5

                          6093f89fd84574f4e69a9b60b2a05823

                          SHA1

                          16c0466a800f2222be1953cb31a73746e628c7ec

                          SHA256

                          b6e6f10e3934c31e19a613b937f2a9831be39a1554f276978005bdc299a5f926

                          SHA512

                          45e5a02b50c21636c2a65e69343e5f0c368d738c3340aa34eb24e906b7d63fa4484ea1b1da103a9431d5be0bf685ae09e888fae454ce5cefb856d8d5011f0671

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                          Filesize

                          15KB

                          MD5

                          8338e94438753523f0e066f7b40d8dbe

                          SHA1

                          38101d2a98fcbaa4b50429d9eec6de4d19cfd158

                          SHA256

                          8aca7d1093c693eded83f7e8810491983746ff4d5aa43abff4c9e981119cf090

                          SHA512

                          2b68ef02ca1f5a350b9898a840643c27b22f09e07a107ee0875c45fdc1b89980334e555856d5fd52f204268d2fb026b47ebac5096f33d3a4f7a0cc063dec5d99

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                          Filesize

                          144KB

                          MD5

                          c8bf8f1d3e04eae12b7def699f2ea0ab

                          SHA1

                          f98d14c13f51d59acb65aa61d8984f04a1e0a901

                          SHA256

                          cd4a8e1b9f07a1a791115f418f021f3bdb791b33d84859bda4ae7a09e6b63192

                          SHA512

                          f1f8fd672182d31d005cf9a349cdd1b94d06114f598a97b5b7b950d3ba9efdcbecf92271490f61e7c20b091e813414f4781d2e556e8de0c08d936b7243d35005

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                        • \??\pipe\crashpad_2724_NWORRXFIINHFLILC
                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e