Analysis

  • max time kernel
    51s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2023 07:17

General

  • Target

    http://4yakffrc.septeimegallery.com/undlivry/4YAKFFRC/#WVd0aGMyZ3hMbk52Ym1sQWNtbHNMbU52YlE9PQ==

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://4yakffrc.septeimegallery.com/undlivry/4YAKFFRC/#WVd0aGMyZ3hMbk52Ym1sQWNtbHNMbU52YlE9PQ==
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4320
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdae749758,0x7ffdae749768,0x7ffdae749778
      2⤵
        PID:4728
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:2
        2⤵
          PID:844
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:8
          2⤵
            PID:3856
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:8
            2⤵
              PID:2188
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:1
              2⤵
                PID:4348
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:1
                2⤵
                  PID:1268
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4516 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:1
                  2⤵
                    PID:3876
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4736 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:1
                    2⤵
                      PID:4116
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4820 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:1
                      2⤵
                        PID:1820
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5404 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:1
                        2⤵
                          PID:2148
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5420 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:1
                          2⤵
                            PID:3916
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6140 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:8
                            2⤵
                              PID:2448
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:8
                              2⤵
                                PID:2168
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5284 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:8
                                2⤵
                                  PID:2240
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:8
                                  2⤵
                                    PID:1932
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6028 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:8
                                    2⤵
                                      PID:5112
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5992 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:8
                                      2⤵
                                        PID:2800
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5760 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:8
                                        2⤵
                                          PID:1612
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5820 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:1
                                          2⤵
                                            PID:4348
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4784 --field-trial-handle=1816,i,3508879000249265999,8498492249974336586,131072 /prefetch:1
                                            2⤵
                                              PID:2192
                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                            1⤵
                                              PID:1868

                                            Network

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                              Filesize

                                              62KB

                                              MD5

                                              b5fcc55cffd66f38d548e8b63206c5e6

                                              SHA1

                                              79db08ababfa33a4f644fa8fe337195b5aba44c7

                                              SHA256

                                              7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

                                              SHA512

                                              aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              240B

                                              MD5

                                              668b588ea2487b566de526193ef8680c

                                              SHA1

                                              3d266370c39a6d23b9cd3415c6740301a572338d

                                              SHA256

                                              c3ab269c91f6abe6433b79c58214d6c30cf2209a6bd4458c8f9cfd2f16167efc

                                              SHA512

                                              f90b4e7b9615c8f558b2a5f71317e29f710f2e8f7c81425ceee4c4bb24172866fa41f3f5a3212fc75e8857d92db7a40fc844ab1b76115c490ac818a7560ca7b2

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json

                                              Filesize

                                              851B

                                              MD5

                                              07ffbe5f24ca348723ff8c6c488abfb8

                                              SHA1

                                              6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                              SHA256

                                              6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                              SHA512

                                              7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json

                                              Filesize

                                              854B

                                              MD5

                                              4ec1df2da46182103d2ffc3b92d20ca5

                                              SHA1

                                              fb9d1ba3710cf31a87165317c6edc110e98994ce

                                              SHA256

                                              6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                              SHA512

                                              939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              ef913c15a6088f88d4eb2db01ae1f680

                                              SHA1

                                              8a1b12082afac89cdf6797c7b7146fda79ed204c

                                              SHA256

                                              cd47ea439f61fc6b1ae3d3fc041f3c723ea3c39839e4d0f229b68c1fe58bf96b

                                              SHA512

                                              72c19c93b00f10d216f10f86b2d7882bfda44b5413029d3c6b28d8c5ef927d2b9c5b2154f5152e73bc03544a02ac582d7dc504f672175a6f4e8e309bba43d9bb

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              d7f4056d000321de5dc9460a7b18432b

                                              SHA1

                                              8d71c50c0d43299d5228ad377fdfd1b3e071bc57

                                              SHA256

                                              876942741b6f5bda9c846a9049a901b6ff20bc202512300846bc4d5b88401fcd

                                              SHA512

                                              3d0602ec841687877b53c875690591803d7a4e6a1b8df71c025ab52576e8704cd91e14c58c15700dd4076449ef2624953a066a5067291c8516a9cecd63dd1317

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              3661ed76236c1c53e371f0484a5b244e

                                              SHA1

                                              4167d359b0fa3bfe90b3f9f518c28d9756523b39

                                              SHA256

                                              1c6aabad7c8f36d9a7d75bdcfac0c112c5d461dab16c3b73880914db2534c998

                                              SHA512

                                              e55f9737a5818f65780d20dfa850b58054cce7827d2d4de716b63e65b42e28f405fb923d875c4121a6bbf50a651fefed131fd8815b3a6bdc905b68eda766046c

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              10KB

                                              MD5

                                              bb8771944c0409a985a19acb8989a131

                                              SHA1

                                              b30a9290e6375bd1159343c251405c7caa9d97cf

                                              SHA256

                                              95a5ad144e802f89cf7d9481c88121b2fe300f04a17cf56bc27f486696f0b361

                                              SHA512

                                              bf5b094672e0086f5d4c4fc83fb8266fe2f7d37615d9c31515fd004e9d2f9c3031245ef6a41b2feb9ee3773a11394d6c6276a65d8c9bb78fc72c7bb881e900f8

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              10KB

                                              MD5

                                              967d71f91c1a1fee441b4ce8b596e7e8

                                              SHA1

                                              efc3c8102f18b966e956a6f8e4e49438620af820

                                              SHA256

                                              56dbddafddda39fdc3a5bcb31bedac04fef4e6897fb8be8286b8838ac0ab52d0

                                              SHA512

                                              984628ef1d8a4bbd69981e5561d9128d71a64cdb2b7a4e0492e99542edfcbec2fc477ebbeec1bd9afe312ab5733eb08ebb4bdd05b56fe656856b16def7910f1a

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                              Filesize

                                              15KB

                                              MD5

                                              7db5273bc75cfa882cd24714f458bca3

                                              SHA1

                                              66cf19bc7ff16b3089fe2afbf45e1b6d11b5ba90

                                              SHA256

                                              ad4dd7a62cfe5c2f6f2e084f64c0a584b9e3e7b80db0e6b7cf4fab0853698bbc

                                              SHA512

                                              ce69aae811f9c8f371543b5c1ee3fe922fb393a1975ed5822850eeb19fb567cd4f7fe21df0403dfcd0dddaf978369c27c8a824000eefcd4cfb8644ed8d7498b8

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                              Filesize

                                              15KB

                                              MD5

                                              72766625785fa547cd442370a4bb7437

                                              SHA1

                                              3365cd9561e3a4591a8b77cc4e7787a9afb028e1

                                              SHA256

                                              903aa6c312fdd6fb841dcfce281b6045b0b998876c0f76b90bad734182e40ddb

                                              SHA512

                                              535bddd881647b4a44cefc88c42dc6bf40747c9998c6e74c3e3128217f5dfc2a2c2d1138eb29bbe50c80dabf653761eb71238acfb00aec214be434358dc00e4c

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              159KB

                                              MD5

                                              708c93a7e6bd75a6aae36a454e053850

                                              SHA1

                                              2dbdc1108784f8c7920eae3432120acf2df637ae

                                              SHA256

                                              5717cd3d56b6ff1d8af334113318337e5536c49aa4dd8b2c80a1eb4c1756f42d

                                              SHA512

                                              470d2ca495e0407c3d4c4c93c36374c57433e691c7bf08e47bcafd953e1d71a562cfbc057fd7dcc4c74cf7ae21cda87f2b97c9c76982a070c0c8b328c1f3da45

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                              Filesize

                                              2B

                                              MD5

                                              99914b932bd37a50b983c5e7c90ae93b

                                              SHA1

                                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                              SHA256

                                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                              SHA512

                                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir4320_1619571108\04a1360c-25d1-443b-9183-fe02ade25f83.tmp

                                              Filesize

                                              88KB

                                              MD5

                                              2cc86b681f2cd1d9f095584fd3153a61

                                              SHA1

                                              2a0ac7262fb88908a453bc125c5c3fc72b8d490e

                                              SHA256

                                              d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c

                                              SHA512

                                              14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986

                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir4320_1619571108\CRX_INSTALL\_locales\en_CA\messages.json

                                              Filesize

                                              711B

                                              MD5

                                              558659936250e03cc14b60ebf648aa09

                                              SHA1

                                              32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                              SHA256

                                              2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                              SHA512

                                              1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727