Resubmissions

01-04-2023 10:58

230401-m2zqgahe53 1

01-04-2023 10:45

230401-mtds2aah5s 10

01-04-2023 10:35

230401-mmtwnshd84 6

Analysis

  • max time kernel
    1800s
  • max time network
    1692s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-04-2023 10:58

General

  • Target

    http://google.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://google.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xac,0xd8,0x7ff824059758,0x7ff824059768,0x7ff824059778
      2⤵
        PID:2524
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:8
        2⤵
          PID:2936
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:2
          2⤵
            PID:4060
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:8
            2⤵
              PID:3036
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2732 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:1
              2⤵
                PID:3096
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2740 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:1
                2⤵
                  PID:4712
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4352 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:1
                  2⤵
                    PID:3084
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:8
                    2⤵
                      PID:4448
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:8
                      2⤵
                        PID:4976
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2580 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3320
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:3864

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2c811a21-6a39-4b80-bbc8-4c56e13a407d.tmp

                        Filesize

                        6KB

                        MD5

                        7b399f182e8ea3c86ede8c2f0186dfee

                        SHA1

                        7422dcb32cabbe94d257198cd57b7751da9af5ca

                        SHA256

                        17e57bf7e1ca883bc776cde05f9daa4cdcd8cec931f1bd47248d25a2e6cc956b

                        SHA512

                        0f335046792f8d7815922454a1c0bc0b856dd865581a53e21039f4f607d823630ea695c3b0bac573abd2021b59f552ef3252ce3a4023a4d45d2810b6f4f04291

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        288B

                        MD5

                        5639fb4d5968247ba3b33cacf0fa848d

                        SHA1

                        bdc05964a9522abc0d0f9c4cb2241a70433d6df6

                        SHA256

                        0ca595379e319ca22ea2d098f62a56572193300f9e1133d3e09f790847fdaf1d

                        SHA512

                        125317d8856fcd1965e550c9c46f20b1d740b46abb47840c61b0d724351003f6084f70bd6326514a375b5fec20928dc1fa2734aade4a064fcc8c7e1402b7d27d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        f87f21dc9fbc045ebf7974a8db246add

                        SHA1

                        b265c43fa57b4abaff36b56dc81e3eaff93ae022

                        SHA256

                        1a73ec0a7f904d7d105061e4fa17ea62cc7784bf8250ebbc7a725ae2d0405978

                        SHA512

                        ba009315fc667eb851d6bd0cccd9145d25566b9999fd456046f326ff6dc5a9bb99e0a189d1ae301564af3ecc8a5cae63b982263c560c0ad9e02c037f1d58f838

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        2e4fbb164b06c69f8af6d6e93e1346da

                        SHA1

                        c392f2800a97b57add03a6b8a8da4b9682bbdbfd

                        SHA256

                        2b95f8f44189e551dfba7135455fac72eaa9da9147de6d3bac6e621fda2760dc

                        SHA512

                        075ccd1d43fc7314212ffd960817c7718187bfd8c13e416edeb0a7c37038b948856c60aecf0afdcdf8d9eb3c5b7980eae1f400162b7cca43e00755bcb0b2b1f6

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        64906d203ebfed8d7768d3ddffd23cee

                        SHA1

                        47ad00cc86fd136798e19851eaaa5c9ee1820784

                        SHA256

                        bb4258fd4cf31bde5a8cb868f7a1a51b9f1782b559007842c06c6d77c01d5604

                        SHA512

                        24eec5954541873feb68d3d62a9da1a59552f1104187487c6f55b7fa1d41d6b8687b2df1f166b58db7c1a037f8dec555eb72ffef2192ec20e830da605d6efac0

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        539B

                        MD5

                        80d1a6a6f9aff797553596ccdcc769fe

                        SHA1

                        a91b726fa5067279e618c0e1bd20ac6183ddadcf

                        SHA256

                        76fbf67d5c0a927a76364d3be0e3e0bc0d22139d942e712e9e4e6b82fa702fe1

                        SHA512

                        31e7d0dc45234458f43e37708d7a5bc2c4a56a23e1248a12d22a2fa5df493b4e5260514d76fc77f823c1f38131b62bb19e1fe9f4847d8f9b07c185a3e1f1aeca

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        078a37026b440f6678dd4652d0a71ced

                        SHA1

                        8aea2d18d30550c34158d0ce89f7eeefa050102d

                        SHA256

                        ae9c376f9a37accb7bde9e06f0c4c91bb85b57ae3bc2ef65a139c90bfa7d5530

                        SHA512

                        88d6a29d068374f73117ced0e07204c5aff1c4a4060821edb0693ffa41182cf9bcf923c2e3bd03a17f3fc43f8ae5adc46a2ea49c2592b46269a82fecfb587082

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        8f2127a61da2b229566195ccf8c645b8

                        SHA1

                        88b8bcb303c7b944038b75710da22e0e005a1777

                        SHA256

                        927997bd6b8cb2f347bb05faf45a3d0a9fb8fb911f03703572364d91164387eb

                        SHA512

                        8b1dbbdd18c1919360dd8c51b3c17c376067c872041e9e4541bdedd8a03551f44561f3b46f03ccdce8e3415bf4383556aa5570f4f12af1e6f205dfaf8a221c59

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        173KB

                        MD5

                        473ef37e98076010d839991c3a37bba4

                        SHA1

                        4c474140e511213c989dad5fcc4ff9984145c1d7

                        SHA256

                        c53efe2a729d8a51095436ee1e3d5aa191b1b34cd21815694d8ac7e842e58ffd

                        SHA512

                        2bca4efe700d623652b36f8d5b878f68882ff901635b7b8ead57ffa5acd9636fcac9f46757406474d2f1a761b7924a8b611f07f719efa7a8263978d9c117457e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd