Analysis

  • max time kernel
    301s
  • max time network
    286s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-04-2023 08:04

General

  • Target

    https://www.google.fr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjX5t3_yMT-AhW8VKQEHSx_CCAQFnoECA0QAQ&url=https%3A%2F%2Fyouareanidiot.cc%2F&usg=AOvVaw36hjTACmKPOCzJrY34wLQm

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.google.fr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjX5t3_yMT-AhW8VKQEHSx_CCAQFnoECA0QAQ&url=https%3A%2F%2Fyouareanidiot.cc%2F&usg=AOvVaw36hjTACmKPOCzJrY34wLQm
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4232
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad8a39758,0x7ffad8a39768,0x7ffad8a39778
      2⤵
        PID:2188
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 --field-trial-handle=1808,i,1237046053053750628,10921318275657930467,131072 /prefetch:2
        2⤵
          PID:4180
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1808,i,1237046053053750628,10921318275657930467,131072 /prefetch:8
          2⤵
            PID:4316
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1808,i,1237046053053750628,10921318275657930467,131072 /prefetch:8
            2⤵
              PID:3712
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1808,i,1237046053053750628,10921318275657930467,131072 /prefetch:1
              2⤵
                PID:1312
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3172 --field-trial-handle=1808,i,1237046053053750628,10921318275657930467,131072 /prefetch:1
                2⤵
                  PID:1816
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4476 --field-trial-handle=1808,i,1237046053053750628,10921318275657930467,131072 /prefetch:1
                  2⤵
                    PID:3692
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3348 --field-trial-handle=1808,i,1237046053053750628,10921318275657930467,131072 /prefetch:8
                    2⤵
                      PID:2392
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1808,i,1237046053053750628,10921318275657930467,131072 /prefetch:8
                      2⤵
                        PID:4872
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 --field-trial-handle=1808,i,1237046053053750628,10921318275657930467,131072 /prefetch:8
                        2⤵
                          PID:1472
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2840 --field-trial-handle=1808,i,1237046053053750628,10921318275657930467,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2808
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:1088
                        • C:\Windows\system32\AUDIODG.EXE
                          C:\Windows\system32\AUDIODG.EXE 0x150 0x338
                          1⤵
                            PID:1740

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            72B

                            MD5

                            54c830798fa96448fe5b31f1c0ca74a8

                            SHA1

                            115507f08caf5a560416d50178362250341bf417

                            SHA256

                            ba7c119a829754c470db5ba94de1f1d9996047dad2bc9f66303bdcef2b8c6191

                            SHA512

                            246c91849f571dac9c8c4e9bb6f2290f04a7307f7a3101450d21e9d7e93d319dd8487a96c5dab7b1b09983c451df5284a51cae54e3b8323a42504aa01c8c8066

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            44b193cf9dfc464c49434848610a272c

                            SHA1

                            d32b8e77a12d1b4862719894cf21fb752a687dc5

                            SHA256

                            4f36089ea674b286f789e5a60ec0131be59a0467aa3a1dfffdce51cb73f1fe53

                            SHA512

                            cd7de12fdc8f1db7b7fd0147b1a074ead7f708e06120422144aa87163e4ff82ec24c4c759688dae86012c10ab077eef67596def47d6910f9bbf678143e4e8cc4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            2d4f50e9b4049f833e93e10c4746e11e

                            SHA1

                            54777136f5dce0c7840fcba538721cd624dc44a9

                            SHA256

                            30f473b230da22590c488d3ef68928e636057ab816b8bce75f6cb58a4b154096

                            SHA512

                            8f0b410fbfdcef27cdbcc9e629d912e0a76c9de114fb216ae7ea80fc607d4fd41f9b1b0851a6ae0f116aaf1bc5afc49793288ee2731489d80666ca177df2d4b2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            378006df27fce3dd45c9429a654847ff

                            SHA1

                            3940f47681be005241b75b35a26c4bd168500630

                            SHA256

                            d52fdfe0f78c7bdb31991cccf5ad694a64a478080142298c97762cd04be785fd

                            SHA512

                            1a07405144122fdddd2edaf89bff682b53f14816a0f7d6d492d0b7374d17c589c9c570265e67d4d74c6d8e8eb2b76ca7fe8d643ed38fe70f76be54f11285f6a7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            539B

                            MD5

                            886caa631c484401348477612e53bfba

                            SHA1

                            38d1ccd65647c5efabfef2c9bb247e773fccedde

                            SHA256

                            b0ce0b9f68c8cac4a1ce342bd51652f6131f0432b59b43b9a78b9c03d425eb47

                            SHA512

                            46d5f18af7bcda26cf1a33dc7c7f1dee1e1588bc4c22af3befaad618091be1060098f5067cd645e8a89997f3bbe75750ec73568070a49283cb574d994d606866

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            beebff18a19526f7664b7cf835a8345a

                            SHA1

                            45456156ff733cb2751b9786bf7ab4fd75c5995e

                            SHA256

                            703eb996b979cdaa19500c4559206cd76708bbfd3aa04e4b5984c5847ae83db1

                            SHA512

                            760d1530589ad66cc3f20bdcbd2a414ef7653dacc24f80be01f76fca241a05b33c6c795d5321745fdc6886607ead57cb3fed4f4ee228b0226e94ad113544827e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            9696654f2092e1b05729cfef42c0cbe0

                            SHA1

                            8acb494034bbb4d4ad70323c0219edfc640e19d9

                            SHA256

                            782938e24ce24ee0b4bed173b4d73544cdee2d5d5e1df94aca8090b32c83b685

                            SHA512

                            369d8a9edbc8d62a9cad36b27946fbd14cddd5c45a1c26a3668f0ef126f06475fef397c18f702493ec6d0427fea60eff7e661930ac5233434830d9b85dd8bc29

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            09e4bdccabc8aed6677bc513da83bd4f

                            SHA1

                            a35932edcf40040b8b7e3ec8f76a8663c14a15a3

                            SHA256

                            76f0f76e5d1fc694906fd5056c3283de8c0c7b083e6ff10559edc40471814169

                            SHA512

                            38b53325e15862c2263e782498b4b09cc49540f741a8e6fcdc2a3e2696f0fbf8171bbfdf83c7f063538f08db8b9347e153e6a3e9605c4450512ed08bd1d10eec

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            200KB

                            MD5

                            74e7e84823d23372ff86fc766b5062ce

                            SHA1

                            c668eb45d2fe2bf6d982a3f4a92b85e37e87455e

                            SHA256

                            59d4046c0a1dbdc7cc6c9723ee95d2ed6aa0645246b86901ef7179e635d26a5e

                            SHA512

                            d123b476399205c091f9f60e4389b6d2657a2437dcf332ec13953fd8e8046e681b1e4d3f8578f598533e22e3a74c74b126ee4822feffbb7831f945aa9a8c0889