Analysis

  • max time kernel
    300s
  • max time network
    279s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2023 17:44

General

  • Target

    https://nkq14ldx.r.eu-west-1.awstrack.me/L0/https:%2F%2Fenroll.krollmonitoring.co.uk%2Fredeem/1/02020000h047kjhe-mhjbbn1q-d7r0-jqqv-hu3i-k9jq98291q80-000000/kDHZ-PM44hBwGqXHPeISDPGCu7k=317

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://nkq14ldx.r.eu-west-1.awstrack.me/L0/https:%2F%2Fenroll.krollmonitoring.co.uk%2Fredeem/1/02020000h047kjhe-mhjbbn1q-d7r0-jqqv-hu3i-k9jq98291q80-000000/kDHZ-PM44hBwGqXHPeISDPGCu7k=317
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaed59758,0x7ffcaed59768,0x7ffcaed59778
      2⤵
        PID:2720
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:2
        2⤵
          PID:2184
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:8
          2⤵
            PID:4824
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:8
            2⤵
              PID:3128
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3204 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:1
              2⤵
                PID:1056
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:1
                2⤵
                  PID:2388
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:1
                  2⤵
                    PID:2352
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3452 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:1
                    2⤵
                      PID:2312
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:8
                      2⤵
                        PID:2080
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5456 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:8
                        2⤵
                          PID:1216
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:8
                          2⤵
                            PID:624
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2852 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4628
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:3836

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            264B

                            MD5

                            37d779dcc8a1209e0392f5a424123753

                            SHA1

                            f1adcd69100b7ea72a4bd330cad1869f72a799c5

                            SHA256

                            57e0dee4d10751e515f472187996cd2f7babbfd76e9199ebf77a69e2c3c7f176

                            SHA512

                            73aec31074f5a47c1fa11af1c81a41d4e8bb64c502fe5fdd49c6492be91cf34565fcc772b45b77006aeaaa351e42ea713b344936f72c96a1c5d47be6a3f43111

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            ab8fc4a2a34e5d76c67a7a27fac53fe5

                            SHA1

                            2f9904242435077033c0a82fde2fff2073571e39

                            SHA256

                            c002ab9220c9097984cf9df6be624acd69c240beb17e953f3db95c776c55466c

                            SHA512

                            86d405d9853e080b8990de931d584492bf092445c39e1ac5f238576ef1f59edf587867b131cac055d24365692bfdcea1eab58483528a66aacbb69dfe6ed790d3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            50cc73f4a8193c2f1575b93bf10d6e4d

                            SHA1

                            fa8018124bd206132c5dff0a6ba48a89e5f62860

                            SHA256

                            3c373ddb879b1f5e64881424ebc5c1e48753b02a07824a3df1e3bbb966f60a4c

                            SHA512

                            540405039968a66f1eaaee87dabe5c82e06864a1300bf7a0e1cc87270b11f261a69898f241b2da25c943ef9bb6b90aabd9ade90eccaebaf44f69e98bf1cca93e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            9664b203569d885269d4cdce93c7f6bb

                            SHA1

                            a3abd6164575e68aa00dfb15ac5e18ad8f09f6a2

                            SHA256

                            e1fc16bede9d1c52dada409587ea1cca3c2fd217f6e48c4b4014ab947a840592

                            SHA512

                            ef16e2c9b95988a08c75bf8a202f66e098dba5402b48c3fbeec0afaab0201efaa0817e38fc5d7d32e9c48525648f10344df906d4168e1c4d3e48028e6a0d428e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            5631353e044d1fbbd8ec97b34da68f79

                            SHA1

                            4de1e74b1577a4ec8e809402175f630e92214ac7

                            SHA256

                            bf6e2760a5c3968fc4700d87213f431d54b0a32e774b7ffecec46b711dfbfd9b

                            SHA512

                            3a1eda454dce6bec845c42d2af2c55464da572a75907119e6c910446d128230a6a558aceb1fd814a55c12675667d9d02a65d130c274e833cde9a876cb685f4d7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            027b9671064679330f25c90d0066a86a

                            SHA1

                            21384eb72e32ccb25365d165372e65ee3b520c41

                            SHA256

                            a7b116417209d087e157b43d428712d5117c46e436cb8acac2bf52003464d1e1

                            SHA512

                            24e410e9c27427d833beaaef155c356fb85d7cee1e638d18254e214dc3dcd42469d4e8a065863a34c977749124f28bcc429cee088cb311c14ee6d644888239c4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                            Filesize

                            15KB

                            MD5

                            47378f4f43d1471bbeaa3bbefc84db93

                            SHA1

                            6ddc9db594f902f571e8c5c33da31542932fb815

                            SHA256

                            10f9c9d53534bbdb2075ac064955da8426ad0805a861b3553af12e8c2eb209bc

                            SHA512

                            12c718b4668e866c36fa4ae4e86933484171884e8b636a2a88649015a8d995a80e491e80f6b98e3a6519934e08cfe41b0d7ce55db6f0dbf009a1be1b5e7a8930

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            200KB

                            MD5

                            4423a27957f745b16b79bbb5bdf9d982

                            SHA1

                            e5c04b9791d71e7523dae1f2b9d73474c56df7bb

                            SHA256

                            be5eb258b20c80f57cc369cd2b83e7e254559056aa8fa541c9c901f97677928a

                            SHA512

                            76381979cc60a9fd4bea5d2657a729b035de18e4253e9d7b6bec741b5d31aea556732367ad610784cbe4ff4dabc8fbbd6752621962dddbecba5d2f248dd734cd

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd