Resubmissions

23-07-2024 15:34

240723-sz3bgaxcmj 10

12-10-2023 09:42

231012-lpmppsbc6v 10

24-06-2023 17:44

230624-wbcmpada5y 7

Analysis

  • max time kernel
    55s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    24-06-2023 17:44

General

  • Target

    mask1.html

  • Size

    2KB

  • MD5

    49da8130d36b92e670879db78ecb7dd9

  • SHA1

    0b5e840059a0283887e8b91545300872d66c3649

  • SHA256

    1d1bdc743563387d47e9fd8c833b5e4364bf5d0c6607792afc012d0e6169277e

  • SHA512

    a3aba7640297c101b2476ac5bb7a91d6961f67c22e2ee87f532001309936c467e3f9db4aec9da2c02634a98b727f8733a6836e78293747a04af26ad3ec8a4235

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\mask1.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7179758,0x7fef7179768,0x7fef7179778
      2⤵
        PID:1404
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=984 --field-trial-handle=1400,i,7371489435290150247,1079088274097404599,131072 /prefetch:2
        2⤵
          PID:1168
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1400,i,7371489435290150247,1079088274097404599,131072 /prefetch:8
          2⤵
            PID:1152
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1440 --field-trial-handle=1400,i,7371489435290150247,1079088274097404599,131072 /prefetch:8
            2⤵
              PID:456
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2260 --field-trial-handle=1400,i,7371489435290150247,1079088274097404599,131072 /prefetch:1
              2⤵
                PID:1920
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2252 --field-trial-handle=1400,i,7371489435290150247,1079088274097404599,131072 /prefetch:1
                2⤵
                  PID:240
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1168 --field-trial-handle=1400,i,7371489435290150247,1079088274097404599,131072 /prefetch:2
                  2⤵
                    PID:2072
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3760 --field-trial-handle=1400,i,7371489435290150247,1079088274097404599,131072 /prefetch:8
                    2⤵
                      PID:2212
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 --field-trial-handle=1400,i,7371489435290150247,1079088274097404599,131072 /prefetch:8
                      2⤵
                        PID:2204
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1400,i,7371489435290150247,1079088274097404599,131072 /prefetch:8
                        2⤵
                          PID:2624
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:1416

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6dd089.TMP

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          084c543aebfcf137f4aefa1b3d6fbe50

                          SHA1

                          06295a416ea1f705a3ee2b1809b9c8e8c9e26c91

                          SHA256

                          46b075e64a083ed6bda49eeb9e0c6fa2d7f2d91b760dd683ae4d5ef4142830ce

                          SHA512

                          1cf15ea62f82436087a7b1511833a1dc3c5ca355645bca837101c5862f96d95b93d806d94498cf28daf698dbfb91a5eee2f42cdd5a42772224d75bf42ad3a4fc

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          6aaf6f31229c2e74252b482b9b49f03c

                          SHA1

                          b26cad5121adfe17f5dabdc266888e5417072c6c

                          SHA256

                          61dea9e71b50418a559c7f9424ffb38037a9ecd50f4bdc03daeb2789239c3fa4

                          SHA512

                          7c4b36e061da553bbd01401d68a378343cb93eccfda97487dd283414bc6c676622f8eb7944eb5514b79f20b207af9a2f12468940b654625097c7aa79bbd0c3e1

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000004.dbtmp

                          Filesize

                          16B

                          MD5

                          6752a1d65b201c13b62ea44016eb221f

                          SHA1

                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                          SHA256

                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                          SHA512

                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bcec7eb9-aaae-4ca0-8779-1e2dac748793.tmp

                          Filesize

                          4KB

                          MD5

                          057fa1b52c4856f46237d21f3d11d3ec

                          SHA1

                          6a220c8cc0fc64fc72db5fdbd42f70a49d42700a

                          SHA256

                          732e99b1b2d39f287fbe3eda47f8c25f20b75a1a1f1906a5ce7be2cc68d7fc2e

                          SHA512

                          9b62db0ee537059a34ae4c383693b82ca09e642f5006548fa1fdb3e49eca39db4f921e602f5df568c18c53ec86443ed78e64272b75609771c9f135b30d6b4b09

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          175KB

                          MD5

                          7677b83d60096e3faf14c736d4d6e80b

                          SHA1

                          faafa9c150883073e2338294ed3d293ac31dbe09

                          SHA256

                          8210a225d20417991e196cdf0caa19d49cfcdcdfb1303644484a97b9a628bb75

                          SHA512

                          9d8175b13590bb94e9fa2a9847963486235e516e3fb7e2b1f482466dedbcf8066af6a8101142648054ca524a743fc7422d5062d92c1a85f3e64db6e718e8b1e8

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          175KB

                          MD5

                          f775042bfe0f0dceb80520a50473e738

                          SHA1

                          bcfc48ffae48bcf2bc8d9e0376dab7ef3c0f4a5e

                          SHA256

                          b090a6adfe0f6634addd3be720266848aa63255fa1a03a0bc882fd517b2c61b4

                          SHA512

                          c453db65ff88e5592092044c309b3fedb881d2444c45f65ff6ae64faa8c2ecf92be7bc13e7a825da5eb18b31f8399988bacdfb2e46dac8ac1944233c20397d46

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          175KB

                          MD5

                          12e5defbed5bc8ee9a59d2f5b49595a4

                          SHA1

                          b1e4375413d50388fb619e1b56fd7f436b73be88

                          SHA256

                          a516244840c2b7696dc6a7a7ccad2e51a58cb3efb4b1f061ff39937972468a72

                          SHA512

                          18c4623bf2e89b9eb38f4079b1545bec5a2f149b463c12b3d52ce20ac8cdb296d126508fcdcd59ebf6475a842a74f7c0b353605855d14c6d9ec1e966726a144f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          89KB

                          MD5

                          452f88535dc8a55d13a8a2e2d7fb5b72

                          SHA1

                          b7e7e0706dfc59e385f651471189b1e5dca95f19

                          SHA256

                          7d6271cb0eb80636bc16d520e2c1b432b34c80059d0b9b0af02079c7f566bc75

                          SHA512

                          8a7aa9bba4890b8deaa57ff95c7726d8f2725cf1c109900faf5e489533b7ef0b8dbc2937c3e5e3a01fa9bd7663111929d10136e172dad8477f228d1b1de6d039

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                          Filesize

                          264KB

                          MD5

                          f50f89a0a91564d0b8a211f8921aa7de

                          SHA1

                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                          SHA256

                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                          SHA512

                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fb7dc0aa-9696-4043-a63c-0cd3cdc4dfd2.tmp

                          Filesize

                          175KB

                          MD5

                          6302298e8274bc2fae77e8c4500206f5

                          SHA1

                          7007891768b75ef2af0b9b18a9de6d7a2ca660ac

                          SHA256

                          1379e95c10e6bfd65b14356bd6d5d3f7e7b152fa193578896fe29853559408b2

                          SHA512

                          3b680a2daf4733b73cebc2a95227e443085a510c295b87d21b99f2f8c04c8b3f0e732efcb9caa71b2598fe80ab51e87fe599bece2ad9daf3fe4662ee84eebda8

                        • \??\pipe\crashpad_1600_KZAQAOQNNUKMDWZX

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e