Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-03-2023 12:03

General

  • Target

    https://hj8x4qsw.page.link/N9CY

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://hj8x4qsw.page.link/N9CY
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3a739758,0x7ffd3a739768,0x7ffd3a739778
      2⤵
        PID:2316
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:2
        2⤵
          PID:4360
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:8
          2⤵
            PID:2756
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:8
            2⤵
              PID:3140
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:1
              2⤵
                PID:1628
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:1
                2⤵
                  PID:2284
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4436 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:1
                  2⤵
                    PID:2084
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:8
                    2⤵
                      PID:2784
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5104 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:8
                      2⤵
                        PID:4484
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:8
                        2⤵
                          PID:3048
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2612 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:1
                          2⤵
                            PID:3136
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=972 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:1
                            2⤵
                              PID:708
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3652 --field-trial-handle=1808,i,17090150914660259616,8993711379079520662,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3348
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:3104

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Discovery

                            Query Registry

                            1
                            T1012

                            System Information Discovery

                            1
                            T1082

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9591c328-f46d-437a-b4ba-efe6ef620a47.tmp
                              Filesize

                              144KB

                              MD5

                              050d6f14c9560f7d2af06aa168e6ef4b

                              SHA1

                              bba1b79a1707175a91d9e217e3d17c7ff6651604

                              SHA256

                              d1a8d9d4cf08c5bd850d19103841824d4d507e5e033a8dbb6344b9db63a3ad18

                              SHA512

                              27bdc105635090c5d852a2dccef9a86082d81a729e38d9e5f5d4cfc03a962fab303465bbdfa149aba231ec6b2a70f65865f2a3391d57362891373a92e4ed04cb

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                              Filesize

                              1KB

                              MD5

                              300c18554224566e019debc65509a1a4

                              SHA1

                              7e1421e9510cc6b7bc2d7b2ca66466e91a2b8080

                              SHA256

                              e36f442373a7f4db7e917ff29e459e7bfd54c329343d1736876c881100544a5a

                              SHA512

                              bb8442990c92d993d78858d14bc20d7779b21d61fe549f3f44a17d5293da0392f8d20448cf26a2e31c4dd109617f32957959b298297168870b42fb9952e59962

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                              Filesize

                              538B

                              MD5

                              2207c2bdbabb72ce5ed323b8c488126d

                              SHA1

                              1a5519573d05b2e7b15d2e5b0d32bb08ecdab4ca

                              SHA256

                              3624dc0c3e51c0d8e8055ae6ff560a1123bb868ecfb3da214001e395dfb039f9

                              SHA512

                              f519535a95a3cf77436297ff66d65fa5b4c98a67bcbb0a88373e6dc3bb795534ea8cdf761bb101c152c459777d808188bbf9a50a9719cae41d90cad57408cbb8

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              d84df6b3b17b9e93284d8c79387d2048

                              SHA1

                              c11f0a5ea4f8765d2ef8535b807a9364eb02bbaf

                              SHA256

                              604242f12fc87eca075d5b6ea2485e2e42f3f6025faad777d7ac141d91408c12

                              SHA512

                              7bc08fc5b6b0672d86e482df770a9253db835301118191b1290238457d9006d5ea4ef650267695932968053bf13f5a5ffbaa9a667051f27ea3660566ddb1744a

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                              Filesize

                              15KB

                              MD5

                              8afe04fff86af65694088dd26b29cfad

                              SHA1

                              d6cbd89e7d176a0c79b600dd528e29e409f05c90

                              SHA256

                              933ec7c2265b656de0a494961a1dfa62d79fcebca1fc1c751c93afd217c2367c

                              SHA512

                              c25d18ce0a5a374372b7aa0ece81a4e7a7fc99500c1ca1134c838a7c55a23582c7b584944ce474a9125121886a4fb9fe4d447e0825c1a326f14787d1e54db12f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                              Filesize

                              144KB

                              MD5

                              159c3371dbcbe4faa7a76019b4ed2ed9

                              SHA1

                              b6fb2fc45d5e9579b5be7f1509af84f406e4b91e

                              SHA256

                              223c0048d8dd51507446e3a272a0eb94dd848e39247f29b48dfd906c08535040

                              SHA512

                              3b12a706fb149bf5ecd1b96411158908923209bc9bd5d60c2c54bc7bca393b9ae6a1b252f674f144f1114f3c192707961c7e3f411e9a9111c8c8ad1d03c11670

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                            • \??\pipe\crashpad_836_UITWWSGUJBUYMTNO
                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e