Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 11:05

General

  • Target

    http://my-account.it-security-group.com/settings/4d335f/3e5bbf09-155e-4410-829f-21127795ada3/?

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://my-account.it-security-group.com/settings/4d335f/3e5bbf09-155e-4410-829f-21127795ada3/?
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9bae69758,0x7ff9bae69768,0x7ff9bae69778
      2⤵
        PID:4244
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:2
        2⤵
          PID:4396
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:8
          2⤵
            PID:1404
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:8
            2⤵
              PID:212
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:1
              2⤵
                PID:4348
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:1
                2⤵
                  PID:1392
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:8
                  2⤵
                    PID:3552
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5384 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:8
                    2⤵
                      PID:4368
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:8
                      2⤵
                        PID:3104
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2808 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:424
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:4456

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        264B

                        MD5

                        fd1819224f4d178dc00b3dd529da42e3

                        SHA1

                        bd7190c5d71f10b6d99ab87785be2525f85b6e77

                        SHA256

                        91f18ceb256e42eb05d933a7fb6131fa6fce049347ddf109c310a6fa95ee8fac

                        SHA512

                        0290bd7a12225b948b35572df27a1f48b107a3a419bedba9f488e9294935ac75bf164bf86737cbe83f343e4d54b9e32f8135e02fffe4cfbb6a419c7cbb94b2f4

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        ccea99f756a1dfcc9e72da9c1fe2630d

                        SHA1

                        706b3743bca4e189e2494850c1faad6f37a7a036

                        SHA256

                        21b5b960777f5d7f09124c570bdd650ae27f4e88540d2ec7b4b4fb717e14fc34

                        SHA512

                        785f7e8f3c2d418dc5c455cb88b1b01efed625a130656910290fa110aa650610f8994085dedfcb294ad9d93e293e59e4ed7f8956d3a264770e2200ef5bccf416

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        084d259b289bc4b6f456b66f42f19dd7

                        SHA1

                        f7888a678a9278a4a31001d09e463d3642b34298

                        SHA256

                        0beb741f72753a87c7e9ede3c71745326ece9c9206f6cb14ea11aa2118cac1af

                        SHA512

                        cc2301f29cb0d0810d633718a2257f8309a7595e5b79e04930daca18081296d1ba13213bf4b0b8a9c42355d7e185be4cc723a0ad7dafc029f387769a55574fc0

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        49b5dcb5f328a357ecdbc23917837db8

                        SHA1

                        f9a0c5f602165b3efce455872aae1ec65f9f22cc

                        SHA256

                        fecc001fb15ce8eb8085ca8a853b0da8ea5f142905a20c39bc791bfb344d7098

                        SHA512

                        36248ed997b562ac28e31c0be67a6c6b7b1b084899d6bacf5c8417449bcd35010f23bf91233d1a09a1669fd52d82a6a3a44972ed0d59ce7af113f63839b83c3a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        f8a5d7eee90d7a8b0112c4e30699beac

                        SHA1

                        ddede1c82e0b58858ee19849d7cdc1d861072d9c

                        SHA256

                        ed853f8bcaa622d3aa2c5e55bf08528b6137fd41aeb9cc9a82b04cf08179e581

                        SHA512

                        08330c81924e5266f3ab92d35cff6225dec99342ccea22a4f93ec3bb3605b41c8623933ba73cd5b5547fc50f5fa11e33efe31fd356f7669ec628722eb71516d5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        ba55fc7ec55ced08ba66f144364156ac

                        SHA1

                        877d825af7433da98231e8e15e649c0bf45da6af

                        SHA256

                        241a8e89d09a7b4b3efbd6aec1ece6515e01db39c50c636616d8242942936b36

                        SHA512

                        d5babeb841e80c5c21ed8a9822554a5bb8c4e5358559aadfff6e96d0e01eb1762bee0b424c0ffe6acb7a6b74238bddaff7a8b22f9c43bbe8de562cebe7ed8f3c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                        Filesize

                        15KB

                        MD5

                        e66942e05a42aece77506f5d493b53bd

                        SHA1

                        b92d166b9f6e761646c7d857f82207430094cff5

                        SHA256

                        e7dac15aa992992e876fcf466ee464132587708da5f8f32e0c57bb0013099845

                        SHA512

                        65e66736b38a22a11b7819cf9d3ce899bf4dfa1ed55237e74b20ae2d3beb30324b2fe33196e51e8e8e5e15a65b4b7b66dda888c7a3edb8655be218470d1c3114

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c1e62ef8-5d2e-417d-a041-33db969eb2e4.tmp

                        Filesize

                        6KB

                        MD5

                        43ef51e24a5c945b361982231671b9d2

                        SHA1

                        5dc076dcf80cf7838bc31b7466a424d0a97994c3

                        SHA256

                        a2e847225450fcd7eb094e2e615112628fd53df1de1576adbda3008d55d5faed

                        SHA512

                        d5e7b42e24faf77ab57b0faba31713cc44e3ddb61043f6d3f51e9d95296ae95e01142aae332934a6cb9841b78f07ed3cf0d340a414e0ee1b90a36a0f822d2ab6

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        144KB

                        MD5

                        c167505a96063b33203ac4afacf2e84f

                        SHA1

                        24e6dcf60a96c0331bb95c8420c7f90113572b15

                        SHA256

                        58a7f26a74c5cb414c059d83ad3a98880efd3930a62f027636fa32330d684f9c

                        SHA512

                        a3668fec003edca6ccd3e1aac8aa2e96b8e5ffc9ea71862aae6ccabd39691d5c174a31f2fb801c29905061ff9e43948b6778cf121d902931f90a1e63ed98ae2a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd