Analysis

  • max time kernel
    664s
  • max time network
    666s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2023, 18:31

General

  • Target

    https://github.com/YbicG/Cookie-Grabber-Creator/raw/main/CookieGrabberV3.5.zip

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://github.com/YbicG/Cookie-Grabber-Creator/raw/main/CookieGrabberV3.5.zip
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bae69758,0x7ff9bae69768,0x7ff9bae69778
      2⤵
        PID:4244
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:2
        2⤵
          PID:1232
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:8
          2⤵
            PID:1288
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:8
            2⤵
              PID:116
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3176 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:1
              2⤵
                PID:4336
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:1
                2⤵
                  PID:1916
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:8
                  2⤵
                    PID:4420
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:8
                    2⤵
                      PID:812
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:8
                      2⤵
                        PID:3932
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:8
                        2⤵
                          PID:3904
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2796
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:616

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          75297bedae2f6312ae23d5505e16d40c

                          SHA1

                          89f2a5137a65bf108c38006464f4487c6137bdda

                          SHA256

                          8aac28c3b360f8610a2032ae25dd0f4638813157d5721115489689df20b25bfa

                          SHA512

                          c838aa37ba4177c17d7e1409bb3724e84a7c214f0639ed977aa63d50a66a766727c86b972bd0cb0efca014b5009c95b712eb8ab60bdc38de8315f3dd7423ad6a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          0aa6f9cd4897cb5241d8d0c1d2692ebe

                          SHA1

                          a6a754c7ccf501082774ab529120f209a0e65fa3

                          SHA256

                          89ad67821d1c8b287117aaeab1d3c2d1524b02a3f5c1aafbe162de297709f936

                          SHA512

                          ad66895e71b570346e504a84c9d0146f5140bcf981ef296a6e04c87145ec24c48f649dcc8cd414b67316910886898e9a4768628f779aa773c14422d9c45a3970

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          f0e38cd67d94e61965ee434eee1c5f0c

                          SHA1

                          e7d16a2dba63b6fbfa682f77843f51b29cd90bc6

                          SHA256

                          9d10876d724f297b309132851f033e0536eb0f706988dcb597bd34a2044425a9

                          SHA512

                          b63cb53f0d15896305a7637d72d9ea6b11c364931b0f6dec07e90ffa08b6c7b74cba7ed3155fbae874ee1932d7670589ebc11a9046ccf3fe5412e81db7f435c6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          706B

                          MD5

                          2f8d74182d3aaa189f2f2b3baa0e31b7

                          SHA1

                          ee2d321dfaa09e0c710766ef11188cdfcece2f21

                          SHA256

                          71e8512a61e2aab195cda8e62deeab930daa0153ad0ea41f3a33bef2d1103cbb

                          SHA512

                          7e0a3c30cada87deb9cf7bc5190184819e09a5bfa6b7ba8c6445406a3a17e66ca00ef46cad02f9c3dd9b93fc23b433092f56f5cf79fa6e103032d59357961891

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          1bc106c6c252005f10128698fa262d8d

                          SHA1

                          8acc57c5cf0c8a84d1b89638e8a01b491901ea2b

                          SHA256

                          b158bb88e0e7fee2df2dc748cdb67dab1518fdb06b65df367832c36c7752976e

                          SHA512

                          d42871d9f80031e7422350df39a16de1dc1520a6337811f0cbab24e53b3eff0413a9ed3513e0c643c4bbcd60edaddc8b3732521e56db378c0750c082a640f09f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          49dedc170853012c7169965c9b8ff302

                          SHA1

                          58368f586e26493bd4eb2c0be25b2b3f90cdaadb

                          SHA256

                          d465e5521cde59969541847545609ab5016280c1287601da25682749b27e8eae

                          SHA512

                          0652abd80c682df012dbea03125265774b61e6f6d3f49b6e350e38db43669f40d3c4ec914ec369667deed60a2945d6ecc3e41f45560bb518ea3b6d4616461585

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                          Filesize

                          15KB

                          MD5

                          f442df6836bd54eed9bdf65bed91c01c

                          SHA1

                          a65ece3b3867a8b988e90ee4d88e4261af3bea75

                          SHA256

                          05fb56c4c8f604fcdb147f2b81c85d001fee13a473f6163a910d40312525c5eb

                          SHA512

                          d3f09c948959050a215a15a387930483a113ae367b64789c50bffda136c83a24d3446286e5456f9ed0c10108b1b1c9a5e427b0aa750b9210b398212823237b54

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          153KB

                          MD5

                          b812fec5dcf56adfdb5e0c9a1dc1506f

                          SHA1

                          ddbe5f4e5414ba1d7d74c03f0a473f07459e70a8

                          SHA256

                          82332788dbdae96490e8be762dd05a307bdd7692b0865adf5407d7c8d77b5c78

                          SHA512

                          0b21e0babb46234683d1a0b1da3bdc6da87d4425ca4985a6071092225207c2714dcf54a573b20b8e7f2d6a10a6860bf3cebf6ffcc21ffad7c3a3db2cee40015c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd