Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2023, 00:12

General

  • Target

    https://indd.adobe.com/view/e76bdd2e-1086-4e63-8d01-d467ec1b09cf

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://indd.adobe.com/view/e76bdd2e-1086-4e63-8d01-d467ec1b09cf
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb8bbc9758,0x7ffb8bbc9768,0x7ffb8bbc9778
      2⤵
        PID:3924
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:2
        2⤵
          PID:4416
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:8
          2⤵
            PID:4588
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:8
            2⤵
              PID:4864
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3220 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:1
              2⤵
                PID:1944
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3200 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:1
                2⤵
                  PID:4700
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5328 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:8
                  2⤵
                    PID:1896
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:8
                    2⤵
                      PID:1060
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:8
                      2⤵
                        PID:2008
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4656 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:1
                        2⤵
                          PID:3348
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5404 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:1
                          2⤵
                            PID:4404
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3252 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:1
                            2⤵
                              PID:1276
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5404 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:1
                              2⤵
                                PID:4204
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3704 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:8
                                2⤵
                                  PID:2128
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:8
                                  2⤵
                                    PID:1104
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4520 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:1
                                    2⤵
                                      PID:4696
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2780 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:1
                                      2⤵
                                        PID:4736
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2812 --field-trial-handle=1836,i,2935514606295886051,11667572091067602162,131072 /prefetch:2
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1356
                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                      1⤵
                                        PID:1904

                                      Network

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              240B

                                              MD5

                                              d39438062763f11917922e92fdfbe364

                                              SHA1

                                              442897c36e6f807689992898bd51ff36593546dd

                                              SHA256

                                              4be9c56202d42c83d61469a23c6ddbfaa081ede2b6835a54c43d6a71e8558b12

                                              SHA512

                                              25adb18825837ebdda13303fd70121c5dc42954ed5ebefd5d8ba41fc672154f3ace9fac12ff25b1089baa40715f37e11fac979070babeb6ddb2e1951ed1d540a

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                              Filesize

                                              1KB

                                              MD5

                                              2061f3cf26f79bc4486a8d0f45e16c90

                                              SHA1

                                              e95cab44ea716657283c34d10c602f05834a7c97

                                              SHA256

                                              1c5a94580eadb17cb0cb7d90210f6cc0eff583633f10f32fd12d3f01572f2426

                                              SHA512

                                              7cbdb640e6dfd23b4e82fded2ef0358a9bc1c1646ab9f26b9e43dac27c13692e70f8218a6bd5e1447cebf0292372e3f4f8b7be6b4a15e3434144391a670bcfae

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              140adce53ca01edcaa7dd1bf1faf8482

                                              SHA1

                                              ec2b1dde8bc3ebe14577228a3a59b6e0883637a1

                                              SHA256

                                              fe1e08fd91a6a4833bb71bae7989e825a4a621d3ccf56c8e2d3e50145cb20192

                                              SHA512

                                              f947693f9ed253b94caefc24b36e16a310c3bb8475702764ff0be2784699138c82d29de335494df9ff77b8e65205305d0b8b322096217bbd5f56ceb6f63a165c

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              563ff0b22a8037ba150b91e66a654a80

                                              SHA1

                                              fc56cbc300112eab3d2602b786b25b1dcf055b9b

                                              SHA256

                                              3e947a91c277c79d2172885a0d36019d4d1f3268055d32c54b9f28626f30f1fa

                                              SHA512

                                              7b95c72ae0b76def012539c37b3a219039db780bb2e1b93ea401be9c30c55f5bbb6a6ce056b52a97aa1ba70a3154203105d17ef16def7cb8b22d30fa65bdaa25

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                              Filesize

                                              15KB

                                              MD5

                                              f5a4a1be7e2dc1a21c7318dadd65e8a8

                                              SHA1

                                              31b35e77676439041194b20d5f4df246df174ec9

                                              SHA256

                                              5b96751a3e7d9f86271aeeac21df44610dbe2e1bac7a74e6f3431f353449540f

                                              SHA512

                                              de90954472ab7c2588ab7d3fbccde42e02e56f6bdd2f90a0dc0e594ef317105aac803d17c28920bef59c20049b49edf66d9912e9d7b3e6432badfa0d448e87aa

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              154KB

                                              MD5

                                              02b6ab6da33337414daf9ea14e314bb1

                                              SHA1

                                              89d2138ae93971f017406ef1532f0e58694b5bfd

                                              SHA256

                                              5095f91d11ea97a77505efb517cd19604c4d82b6b1fa63daa2246d43a7cc3087

                                              SHA512

                                              97009448a720276a34f839b0ec9c340ea9ff51a4103e84cc7ee0f32ea6431de40dffd47cb524b9a8feb57db3802dcdd5756716d32b11859e947f7bb26c3bb431

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              72KB

                                              MD5

                                              396a4d0f17c46f034cd4f3a843767a32

                                              SHA1

                                              fa6912b9039cdbff869e1edd8537a9da2c85e775

                                              SHA256

                                              2bcbe6d7b3fa4a5900ff6b8fb774eb93915f2a2cc9b34ff6042bb8a8fe674cba

                                              SHA512

                                              19560b1a8b6baf7b507a117906709f79e176f2b8d648e6ba516d2649ffe3e0171d85263531f525954bce24cec4f9e3f97e635f6b7000d7a26933c44f75526b95

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              154KB

                                              MD5

                                              0de3b1f9294fde999ea4a7fab639f25f

                                              SHA1

                                              7c429bbb463c00fc097ca72a2ce531896d885899

                                              SHA256

                                              81dfe10efd00a3a9fc105ba5c64c10814c206e79fa3159cf5b93fb842df69844

                                              SHA512

                                              ecaecb4fd8034e90e00c43772fc36f26b1824b1cb9929c9a9eab1e3013a1de2853146fe70ae1a770e72e688778787d5a0404ef0b363a45e47343f215076cb17f

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              155KB

                                              MD5

                                              bea5d977af713f6a57eac748f42ea68f

                                              SHA1

                                              938187b2b3631edff9bc758ed87453645aac4722

                                              SHA256

                                              c97a72052439befe16ee40d730c92a73de763b52c981a7310d940dd03b6faa11

                                              SHA512

                                              2826264a0fa6ab8be1b960d256344c14813d14385370a7f757709b2f76c199533514efb5cd6ebdb4248d7277079a5a2d3acbcb67bffdb9621a34638d2c25dbba

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                              Filesize

                                              2B

                                              MD5

                                              99914b932bd37a50b983c5e7c90ae93b

                                              SHA1

                                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                              SHA256

                                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                              SHA512

                                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd