Analysis

  • max time kernel
    116s
  • max time network
    114s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-es
  • resource tags

    arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    07/06/2023, 15:11

General

  • Target

    https://aeneasclosure.website/h8G16tfxhg8*vCrNU**KxNJyvjQbDpJGGp8c1MStl0h4WgwFACzZ4BsV*lH_CxIJLfS3*b8qwGi8j4jBxveVfgllUmmVnnW

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://aeneasclosure.website/h8G16tfxhg8*vCrNU**KxNJyvjQbDpJGGp8c1MStl0h4WgwFACzZ4BsV*lH_CxIJLfS3*b8qwGi8j4jBxveVfgllUmmVnnW
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff843239758,0x7ff843239768,0x7ff843239778
      2⤵
        PID:4396
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:8
        2⤵
          PID:2284
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:2
          2⤵
            PID:3232
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:8
            2⤵
              PID:4636
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1896 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:1
              2⤵
                PID:4576
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:1
                2⤵
                  PID:4452
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:8
                  2⤵
                    PID:3508
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:8
                    2⤵
                      PID:3776
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5132 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:1
                      2⤵
                        PID:4952
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4916 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:1
                        2⤵
                          PID:4756
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2996 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:8
                          2⤵
                            PID:592
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3088 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:8
                            2⤵
                              PID:656
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1548 --field-trial-handle=1804,i,16867000886156237127,769440953539888518,131072 /prefetch:1
                              2⤵
                                PID:1916
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:976

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\33876ebc-0727-4f66-80f6-ac2e8a9f9741.tmp

                                Filesize

                                159KB

                                MD5

                                b1e147383699059639d0491829d7ec1f

                                SHA1

                                7207ad19312406830a3cbcf64d6648028062b312

                                SHA256

                                366a50510232bbaf9a88c1bd4820220c6e313be8501ebd3c4935288828800191

                                SHA512

                                a57487c7bd5836ecfcea00cbe2d236d45f0367e17d388174e8951389366e124a7659beb6ba4f08dce08ca4125409290f532c198cc32174cbd3301ca84e64c574

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                539B

                                MD5

                                30a38e6bfa8af771b155e528751d4bee

                                SHA1

                                4be08c8ca6311c42c71923121e6de62b53c6d81b

                                SHA256

                                7819a6a5b41b8367b6d5983849a4929dbbf99b99e478ff8b9244b37400549b68

                                SHA512

                                0e8249fdcdc6af26dc82fd03675d54d74bde5bce24e39ec860264ae3431ef8a4d0accbc1ed61f305bcfc9086dd4a087f1d396e325d7f13273f4e260c11edaa98

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                707B

                                MD5

                                b71a9aa7664f0007d87d7cb6b26a9a64

                                SHA1

                                5848780a6c4bbfdf1aac9fcec75abec7a79115a7

                                SHA256

                                7cceab98a862bee08332fc6d02a15f9412cea6c639ff86d195fe6fa589b61e5a

                                SHA512

                                4382d274936a0ccd50877a5f64079ae22cb887aa833356e0f75f62aae42b14752cd13118f65b6209e2bd4cf95e829d97ad3c64412cb113bffad60baece19c403

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                7b6670cc2e0b7a51fb788b0ebdf4d1ca

                                SHA1

                                b96556d0e4542d59b765b93e1e80740bbbfee0a1

                                SHA256

                                744882c584d2fc97307784a65612a75357b76a2a2a82fa1f617e95ee9936c4ac

                                SHA512

                                2d9fce892dd1e3aa25fb33f94b59517f5ab22dcb51d0adc43f0da65a90e4136ddfc5e1082679b8cdb5ff4ab95d9446ffbe55f50306166868dbb16f793436694a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                71fe0d3764fc0b147291b4e1d297450f

                                SHA1

                                002a1289e1918789131df3dc057d18c6be079343

                                SHA256

                                b08b0c6df496bd08fadff500b8ddc80f61f01bc1c2922a49d56858f14cf44029

                                SHA512

                                7e21116335e2e08b454e6aa9cb6aa481a2bd61be919d0dc732be376d8042b783040d261940517e9f8b54eca54c873ecc0b012ae2174dbbfbeda04100c6616f4b

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                dc3151bf8272ba2ad9ef30ce4346bcd7

                                SHA1

                                58b5c7063a065c5253e20263a55e4e07b87c5255

                                SHA256

                                9f5a3f3ac0dd99c23f297a4a8c93533aec145c5d725bdc9ec5ecede59c309d7f

                                SHA512

                                84e2c36788ae05dfa6cec5fa3420dce533c0221213ac49934fb496f698ca7472f601545c054f0025c7beb6d811b8956f9c9df5c73a205113a8f76fb2a9a8109d

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                50c0f714d173727c109e6c457ffe8843

                                SHA1

                                a949e43d4b9b4d77008b21fd2672165d23141c66

                                SHA256

                                2818a33673d8b107fb76dd86628e0627d35576d7ea868ee71ac61f222909d4c2

                                SHA512

                                5c25436a0e580b61fcaa2237426a6d94adaf523b35eae64ba64dc5de94f3452f787b6adf594d40bb7448f4467fbf14feab514b860029c59d8d90d1e8f879c046

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                160KB

                                MD5

                                f396af9dfbf1c56ad41401684310f03d

                                SHA1

                                2eb5936d7b7a692a886aa02c8213d249210e4864

                                SHA256

                                9ed78f9e807af859ad6e1748839f5a799096233f874f73768bc3c3c760e2e119

                                SHA512

                                beffa8628f4a182fffa1df699aeb9ca657e051729546dca741710260af860816cbba596af744e9c944ff9b8f62d79cc0d0e40d32b8ea083d2172a01260d00bd2

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                159KB

                                MD5

                                25b3f3b3a3060f5545107a8a6bed3df9

                                SHA1

                                0afe7af0d6ce397234cd92f026508055592b2495

                                SHA256

                                f8698a6c893c0383419462e5ff943cc588b4afd7dcdbd24e492829a3df45b534

                                SHA512

                                fc0c293848cf360e56d7213253d01bf16d28bbf908369ad78e8b05e2f3c83def49b5c516099687cf0514b724623be3cd04e2571f8d2373dde11da0f63134340d

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                72KB

                                MD5

                                03bc4707c827eec17e40b64fceb11904

                                SHA1

                                d9f9daa1a0fd0e06a29b82d7ae6aa9abc3ae76cf

                                SHA256

                                f4b19d27979fd687cb77079f6052f6d8dd8a5912a1c82a606ac7fa99065107d2

                                SHA512

                                530ef26035264528c66fe9f4235f669e498634362568795e50ce3e353d26de52b59455632612ba51027a45b988988d574a2a321c18417274ceebb331bcff6d79

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd