Analysis
-
max time kernel
664s -
max time network
666s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2023, 18:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/YbicG/Cookie-Grabber-Creator/raw/main/CookieGrabberV3.5.zip
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
https://github.com/YbicG/Cookie-Grabber-Creator/raw/main/CookieGrabberV3.5.zip
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
https://github.com/YbicG/Cookie-Grabber-Creator/raw/main/CookieGrabberV3.5.zip
Resource
win10v2004-20230220-en
General
-
Target
https://github.com/YbicG/Cookie-Grabber-Creator/raw/main/CookieGrabberV3.5.zip
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133295203084589683" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 2796 chrome.exe 2796 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 4244 2080 chrome.exe 85 PID 2080 wrote to memory of 4244 2080 chrome.exe 85 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1232 2080 chrome.exe 86 PID 2080 wrote to memory of 1288 2080 chrome.exe 87 PID 2080 wrote to memory of 1288 2080 chrome.exe 87 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88 PID 2080 wrote to memory of 116 2080 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://github.com/YbicG/Cookie-Grabber-Creator/raw/main/CookieGrabberV3.5.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bae69758,0x7ff9bae69768,0x7ff9bae697782⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:22⤵PID:1232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:82⤵PID:1288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:82⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3176 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:12⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:12⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:82⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:82⤵PID:812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:82⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:82⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1812,i,3947815365878271142,3148944815473102835,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD575297bedae2f6312ae23d5505e16d40c
SHA189f2a5137a65bf108c38006464f4487c6137bdda
SHA2568aac28c3b360f8610a2032ae25dd0f4638813157d5721115489689df20b25bfa
SHA512c838aa37ba4177c17d7e1409bb3724e84a7c214f0639ed977aa63d50a66a766727c86b972bd0cb0efca014b5009c95b712eb8ab60bdc38de8315f3dd7423ad6a
-
Filesize
1KB
MD50aa6f9cd4897cb5241d8d0c1d2692ebe
SHA1a6a754c7ccf501082774ab529120f209a0e65fa3
SHA25689ad67821d1c8b287117aaeab1d3c2d1524b02a3f5c1aafbe162de297709f936
SHA512ad66895e71b570346e504a84c9d0146f5140bcf981ef296a6e04c87145ec24c48f649dcc8cd414b67316910886898e9a4768628f779aa773c14422d9c45a3970
-
Filesize
1KB
MD5f0e38cd67d94e61965ee434eee1c5f0c
SHA1e7d16a2dba63b6fbfa682f77843f51b29cd90bc6
SHA2569d10876d724f297b309132851f033e0536eb0f706988dcb597bd34a2044425a9
SHA512b63cb53f0d15896305a7637d72d9ea6b11c364931b0f6dec07e90ffa08b6c7b74cba7ed3155fbae874ee1932d7670589ebc11a9046ccf3fe5412e81db7f435c6
-
Filesize
706B
MD52f8d74182d3aaa189f2f2b3baa0e31b7
SHA1ee2d321dfaa09e0c710766ef11188cdfcece2f21
SHA25671e8512a61e2aab195cda8e62deeab930daa0153ad0ea41f3a33bef2d1103cbb
SHA5127e0a3c30cada87deb9cf7bc5190184819e09a5bfa6b7ba8c6445406a3a17e66ca00ef46cad02f9c3dd9b93fc23b433092f56f5cf79fa6e103032d59357961891
-
Filesize
6KB
MD51bc106c6c252005f10128698fa262d8d
SHA18acc57c5cf0c8a84d1b89638e8a01b491901ea2b
SHA256b158bb88e0e7fee2df2dc748cdb67dab1518fdb06b65df367832c36c7752976e
SHA512d42871d9f80031e7422350df39a16de1dc1520a6337811f0cbab24e53b3eff0413a9ed3513e0c643c4bbcd60edaddc8b3732521e56db378c0750c082a640f09f
-
Filesize
6KB
MD549dedc170853012c7169965c9b8ff302
SHA158368f586e26493bd4eb2c0be25b2b3f90cdaadb
SHA256d465e5521cde59969541847545609ab5016280c1287601da25682749b27e8eae
SHA5120652abd80c682df012dbea03125265774b61e6f6d3f49b6e350e38db43669f40d3c4ec914ec369667deed60a2945d6ecc3e41f45560bb518ea3b6d4616461585
-
Filesize
15KB
MD5f442df6836bd54eed9bdf65bed91c01c
SHA1a65ece3b3867a8b988e90ee4d88e4261af3bea75
SHA25605fb56c4c8f604fcdb147f2b81c85d001fee13a473f6163a910d40312525c5eb
SHA512d3f09c948959050a215a15a387930483a113ae367b64789c50bffda136c83a24d3446286e5456f9ed0c10108b1b1c9a5e427b0aa750b9210b398212823237b54
-
Filesize
153KB
MD5b812fec5dcf56adfdb5e0c9a1dc1506f
SHA1ddbe5f4e5414ba1d7d74c03f0a473f07459e70a8
SHA25682332788dbdae96490e8be762dd05a307bdd7692b0865adf5407d7c8d77b5c78
SHA5120b21e0babb46234683d1a0b1da3bdc6da87d4425ca4985a6071092225207c2714dcf54a573b20b8e7f2d6a10a6860bf3cebf6ffcc21ffad7c3a3db2cee40015c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd