Analysis

  • max time kernel
    1682s
  • max time network
    1712s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24/05/2023, 18:35

General

  • Target

    https://ecv.microsoft.com/gAvP2GFWQW

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://ecv.microsoft.com/gAvP2GFWQW
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6949758,0x7fef6949768,0x7fef6949778
      2⤵
        PID:1776
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1232 --field-trial-handle=1152,i,7074096786457925766,11146792120714692489,131072 /prefetch:2
        2⤵
          PID:728
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1152,i,7074096786457925766,11146792120714692489,131072 /prefetch:8
          2⤵
            PID:1192
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1676 --field-trial-handle=1152,i,7074096786457925766,11146792120714692489,131072 /prefetch:8
            2⤵
              PID:1284
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2352 --field-trial-handle=1152,i,7074096786457925766,11146792120714692489,131072 /prefetch:1
              2⤵
                PID:1312
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2388 --field-trial-handle=1152,i,7074096786457925766,11146792120714692489,131072 /prefetch:1
                2⤵
                  PID:284
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1560 --field-trial-handle=1152,i,7074096786457925766,11146792120714692489,131072 /prefetch:2
                  2⤵
                    PID:1616
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1152,i,7074096786457925766,11146792120714692489,131072 /prefetch:8
                    2⤵
                      PID:2740
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:1616

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                      Filesize

                      62KB

                      MD5

                      3ac860860707baaf32469fa7cc7c0192

                      SHA1

                      c33c2acdaba0e6fa41fd2f00f186804722477639

                      SHA256

                      d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

                      SHA512

                      d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      344B

                      MD5

                      ed5fb36d5a25bd1fec27ac96302d0226

                      SHA1

                      8838cc00d55971f94bed2987c86cc979bd95cd5c

                      SHA256

                      ffdaeabb1e215c3ac76985756c90cc7c098b03d4a81af573500c1c97724f303f

                      SHA512

                      c07e2eac8bd11af1d6680fc65fb4f0a97d7b6480868eb7c2e9a4c73eb5c185243212e1e2b2e5ed022b9c98d32152edcbdacd1a9e3e7e70cb3b32736aed24f54b

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      344B

                      MD5

                      136f1706a7cddd5c74047f728cf29703

                      SHA1

                      e8cc8c0d9bd0df3acc3715d125ae98fda66fd040

                      SHA256

                      5a2464124ebc0f53c36048070d200193fcd569000bfc91d2b335c9468bd6fc5a

                      SHA512

                      c9b162b2b37560d867e5212abe6519e78558cc0628199ddfd02abd0b1925a99a8b32c0e2b48083e46941158e3dfeaf6aa00af8204d69588b2c449e063603a4b2

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      344B

                      MD5

                      2f723d11c626b15b8318df7767bc44b3

                      SHA1

                      ba8a20ba0fb0c31ff3b46bb05618e4505e581584

                      SHA256

                      dfe00dc2ed2b62a0895e0f992ba9038f772cbe9f8365c855a524442c76a36d76

                      SHA512

                      932d670bf1adba43f31d25e95cea77d3a90bf1bd55bbd562fa54afb697d1680601fd37c4575372f16e3cf97692b278fde831f54358b726853b9a3b692ede10cb

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      344B

                      MD5

                      d9877e6ac4bb523c2ec68ca9e9811372

                      SHA1

                      fc5b1c1e2b90d8f23942e24f12ee9bfd7542894c

                      SHA256

                      652959b367b6e3ee1e4cad26e1611bdfe402a6525f2939ade69ba42622a7ce0b

                      SHA512

                      aed6ffb93f3ae496917ddb161dba09cf4fab85e4db31e684e8d71218b2817152b6379aac9785733d0a3368c6d820103f2b14eaf1fb96bd0a7b96fd8d94416c5f

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      344B

                      MD5

                      4aa612b632f4184f3a35c7d8deee782e

                      SHA1

                      30676fc2ebb4b3e6bb47b2ab589754c6e81f2504

                      SHA256

                      86ea7381202d35ac4e20bfbbbf9dbef8fb07ff839038a57a49da5ebb93ba0506

                      SHA512

                      10244635f1e1a5b713312e61216f36e7bc6a7d5826facd28b41e6b3930bc4ee0058475d69f288dbd43f1d8773dd9fc5cb8a4c591436bed1c10e62e3b93fe37ea

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\12f53340-18db-4987-87cd-a883d60a69a2.tmp

                      Filesize

                      4KB

                      MD5

                      3bfa20c71f9a16805f5b7363f1dcfe3c

                      SHA1

                      b0ba4d69c7a83dd06557e332a6f2a3f0ded1d14c

                      SHA256

                      8ce767a3188a0d8c4d0e45db454aa3014f95195ba8afcff1f960636b4b357cc9

                      SHA512

                      f30670807a37bc1925259e2136f34b914333a7e651da2ca39a14531f3cede1da84493de607f66c2c1edb610b3c0300b2ab5a52d73b310f0445ab652fc44d9a33

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6d5207.TMP

                      Filesize

                      16B

                      MD5

                      46295cac801e5d4857d09837238a6394

                      SHA1

                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                      SHA256

                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                      SHA512

                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                      Filesize

                      264KB

                      MD5

                      f50f89a0a91564d0b8a211f8921aa7de

                      SHA1

                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                      SHA256

                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                      SHA512

                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      526B

                      MD5

                      fc40155cb8c61fd41bc0d9158fbef06d

                      SHA1

                      694b36f50e0c5a76f1c147b44ab95061f4c50a92

                      SHA256

                      dc340ee9dd91011155d9ceee95d49e96ae7081f8443f09ad63ea26d722effa0b

                      SHA512

                      997ec0e1bed85954abdc403c70387f20464a23f154e40fe836da27082ab4105c46f7b2874d19ccc808b3fdbeebef8b0a5926165fdd27e509252ce27398536285

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      4KB

                      MD5

                      d22491ed5d4174f21a3e247a097bebaf

                      SHA1

                      d3123b7e58ff028cdc1b612b3fa7220e4fce3d2c

                      SHA256

                      1aeccbf83d1b3b328670e3a7474e5aa00d2816fb60ae2eaad869a3134a33245a

                      SHA512

                      09ff1e6055e6f07904af08e1d5579b62ba667e42f51a0921e9dfb1789aa8aeb98ac48c8da6950cc51dd312c95490e93ea4e29bc0cb1c4309229c20adbd1e13b1

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000004.dbtmp

                      Filesize

                      16B

                      MD5

                      6752a1d65b201c13b62ea44016eb221f

                      SHA1

                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                      SHA256

                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                      SHA512

                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                    • C:\Users\Admin\AppData\Local\Temp\Tar4533.tmp

                      Filesize

                      164KB

                      MD5

                      4ff65ad929cd9a367680e0e5b1c08166

                      SHA1

                      c0af0d4396bd1f15c45f39d3b849ba444233b3a2

                      SHA256

                      c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

                      SHA512

                      f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27