Analysis

  • max time kernel
    151s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2023 09:19

General

  • Target

    http://1xdll6.sewep.cc/34546de4235m342356

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://1xdll6.sewep.cc/34546de4235m342356
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7e6f9758,0x7ffa7e6f9768,0x7ffa7e6f9778
      2⤵
        PID:4500
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:2
        2⤵
          PID:1420
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:8
          2⤵
            PID:4172
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:8
            2⤵
              PID:2288
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:1
              2⤵
                PID:1684
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:1
                2⤵
                  PID:4496
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:8
                  2⤵
                    PID:2520
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:8
                    2⤵
                      PID:4988
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:8
                      2⤵
                        PID:2936
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:8
                        2⤵
                          PID:4932
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:8
                          2⤵
                            PID:4604
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4648 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5104
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:5004

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            954B

                            MD5

                            d6d88bddf985c7eba0b588c85f12f62c

                            SHA1

                            35170d83a0076dd835c4fd17f5c585ea38625c18

                            SHA256

                            0e7fc72f095bf3878c071a76e3933d20acc8bf9b40e305eadcb6948975d50575

                            SHA512

                            2c8e1c288eb3019fcf6ce0081d186526c7c06251d186a94751fdd0c7b53fa45de48e8eaa36855d2e8beaf313154104775c0e1a52feee1e3ccaf53d7166d846d1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            539B

                            MD5

                            c8b72e410b30a656074a496086525eb8

                            SHA1

                            08c43ff4086215559033f20a71f185b8e8b235b5

                            SHA256

                            06395e10f788ee1bec9f0f0076d5b15ca58d4ee76079ec123d9dffd280561eef

                            SHA512

                            e82b199d4a91fd3eb96e308e1cacd892b979598ebf0988396a69b3ada8875c1104f7a24a7d5e160043dc11bc562ac49a243c507a37791cb7b916c4a950d24285

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            f624ef46deb617cb226d3c4f5c090f9b

                            SHA1

                            76bfac6d9fffdebac052983d3093e9b803e11965

                            SHA256

                            978d358d2ab6bd0e09b91eab4a7ce1dac6bf3d92a25c56a6722a638b9d5bb983

                            SHA512

                            470d171625d38be33960a6411613d9434f7783e2188c680d588a35bfed6140ed258978c7ba55479b506d2fdeff12160ddb415d6a5510fdba3c3644b26f5eacb4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                            Filesize

                            15KB

                            MD5

                            0541cf899ff303b3f029362dd2dabc9e

                            SHA1

                            6d85ae6a1a2080f23f1a0ea194659764e6d3fb09

                            SHA256

                            fb109f67518c90f3d61ddca545c776bc326191108a89b76fedf8d260d4c63d6c

                            SHA512

                            2b54f7a9449e2fb02556da30cbf5c917bcae2a5f98ac099f4bf754c6fc73c66bf2d5c627c922193e4194c0d276684ef8f809c69e0957e53b94f1b302e0e39518

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            153KB

                            MD5

                            7d8f1461522f4a5e554fe5c8997ec635

                            SHA1

                            309f94343244c23b29d490000239814d3f973471

                            SHA256

                            e163621f170f2cb3c3d388134e3b0101d34dc16f6d3ce313035821f9dc22cec4

                            SHA512

                            bd2deee260ae70b8b3fc7f479a0ef832b36c2e30bc01dfd67854ffd98bf826b28cbd36afa0954ec2118e9b071473753881a09b2f9a5a51e89230fd9cec576d4c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            72KB

                            MD5

                            a969201483796cfa96f0c5c197278126

                            SHA1

                            eefd9f13f5bf95ad9e4bdbc4dfb414bacc2bd440

                            SHA256

                            9e3f83adde1271af99e22fcd0d7708d4b78908a53e521a3c0bf69b026cd04815

                            SHA512

                            5695594a89f5b78ce7ece2bf688ac540a26dd8830db55d90a4bd6be2a13039687d84681524c4e184f76361f793127a1f6e5db680a1292c86e515255d8adf15fb

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            153KB

                            MD5

                            3cd125078cb633476f30097b6f6807bd

                            SHA1

                            eb4f5dcef01ad6d23366d82cbb3666ce7a27c635

                            SHA256

                            6ddda6792be0666006d464f5630bf498e703d5db7672656e17fc7d806a5eaff3

                            SHA512

                            2c328c8d5e945d1c097984ee76e2a3056699822a3d6daff34cf95cb84b6ca8da6ac039d2e00aafc138498509251373fce17fbf3370fd025c365cb1690c54a395

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            154KB

                            MD5

                            c4b029b203b6ac097c3940e15283cc83

                            SHA1

                            1770d982d0a2b2b3c83b2f309924a972c20d8cf2

                            SHA256

                            3987c98e1ade8d54f5b0696c8da41b6bbb08998f6f58371e18f0d529daf7650e

                            SHA512

                            13cdda5bbe884bf000f59bc4defdc6e2f31f7f1e02417669d60a0e36b4df70ab6f71c78065d1e247f60eee8f8014cb9e840baa0fb14347b70b2c641a59fc5838

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd