Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-06-2023 09:46

General

  • Target

    http://www.cnil.fr

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://www.cnil.fr
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb4a69758,0x7ffdb4a69768,0x7ffdb4a69778
      2⤵
        PID:2996
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:2
        2⤵
          PID:4444
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:8
          2⤵
            PID:3896
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:8
            2⤵
              PID:3204
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:1
              2⤵
                PID:1268
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:1
                2⤵
                  PID:1392
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4848 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:1
                  2⤵
                    PID:1124
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:8
                    2⤵
                      PID:832
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:8
                      2⤵
                        PID:4216
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:8
                        2⤵
                          PID:116
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2840 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2756
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4152

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          96B

                          MD5

                          43b9b4c1851c7e7972384026b306300a

                          SHA1

                          06c5b30c880ff2d2efbad2bbd8e3b654be91c410

                          SHA256

                          2d4a58ab96f54f2acd667e0311dc2b74fca45cba8a56c4f13aab6af92fb3f70a

                          SHA512

                          02ebe7980b589f1b47c2ddc0197fa0f11e56f8ea82d5a1a6d1cb249e22a5279c5f63e028884fd96620c1e122da96b1bb9f7b6dc7a922b38dd066792a0948a7f6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          144B

                          MD5

                          231e06c5aa58bd53635ab72fb1ebe4a5

                          SHA1

                          9d95ab6f54f9b7f474ebb49944c8248f4a25a322

                          SHA256

                          30907b0312578289c7f91628f95599c379f48c1d2a48d3f326fa733274a7c377

                          SHA512

                          17028d6bf945a8b5190e129243727e6d255720f93713aa6e59a1a47d3835a65dd2058585eb1e75ed62a0b922cdd18da5c992a5b55e17cde3ae5731350e904b60

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          ebb37afab45fca3e2ccab90ef495070d

                          SHA1

                          359da34dbda3d0fd2d3ffbd14731afa11202adcd

                          SHA256

                          9bed6bbe3b3746d4c72484f90c174311f5ea18b1b43e2cee8f8f5d25659c73a1

                          SHA512

                          d6d8902074ccaaa0a0e1c9bb5697d069c34280993cf367c4e03bc807e3df22605d8a63ef41f90444eabbb14adf797e8fdeb4b4889bb2fa3fdcf9692a7ea3b276

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          706B

                          MD5

                          bf7226a3827fadb0b8f99daf8dae1b32

                          SHA1

                          9c395175f675473ff2f75b52afbf44f7ec1e1f30

                          SHA256

                          39c7ba53614177aa300e7d27a4927e0ad81d36b63870730f533e1c761e8dab24

                          SHA512

                          d7efe6cb7c3fe9b076e062d331875712cbe962e36970f039154788f8377cd541cd2c5bc0a7d6516b0cc6d5d8e5670abfc0edf928c3a174ee0cdc72f6e72e5f44

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          706B

                          MD5

                          8c9802acb4bb7fb2756a576a7de665fd

                          SHA1

                          eb8592f5adca8db866d1dd0d985e32dcbd5a2aab

                          SHA256

                          bccc7a8eff5dd6899dcec391f4af1f4a4b1dbdfc6483d69bda8e941e5323de58

                          SHA512

                          7274cf65d6378f882194e210981a53ca79d7c8341f2c5fd4d9119b541a2314d2667c20daad011a081ca1aae667a4c93c0d1b6c8aa56bf766f6964be719172c31

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          e066adeed6fd023fbc738e86d0216db6

                          SHA1

                          3d150f27b45490f680b6b31dcf231361237285a7

                          SHA256

                          7df36d91d654a15af8312d7589e7e5bfe7b5566a81eb52a2b2e47965420a45f3

                          SHA512

                          260ff0b87b316ac44b945e17f58d29915de0783f71bab287228e4ca95e63de9859d8ce642fd1e967a4d7ddfe8109b4e830bca771e4d0977b93a8732618dc0d97

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          cae9eea654161485f12efab0d69e81c3

                          SHA1

                          c045d2b5e3bb40fb3099ce066d9c283cb141b9b9

                          SHA256

                          4c03102aea30d449c37ccc526f5dd2cabd0c242ad9b61f9ee18c01ce80de930d

                          SHA512

                          56e90f0e514ec96a714678347c638e120cafdbd8837db3fff20f37a905d0b404ea39065c15d3552589641dfda7ac332aa54f8447e9ba3a37c123299e2bae6406

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                          Filesize

                          15KB

                          MD5

                          e391c4becef52611f06efe91592a5311

                          SHA1

                          409241162e2be4bbaaa0c84c2b65f03a1245db64

                          SHA256

                          861bb23a1e92da25e45af3af4865a2c5dc320436ad226c616619f11e6ee9b08e

                          SHA512

                          29bd1322da1d097a895711335e0196bd3518aef2f806da7b34024ef3e28e7c3135a7229044923d7d7701657a9170b375c651ad50001f426368002fdbf4fd313f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          172KB

                          MD5

                          c9876db42ab4cad75e21d51df9d59d84

                          SHA1

                          c5bddd77ccaaafd6ae41a9d19c4f9bc5b95a296a

                          SHA256

                          4dc9498f1ac03c960429bf42a2ab3c95bc8a81339b6545a4f79924ebefe1ad27

                          SHA512

                          b32ee293f230818da9e14bd2839306a80ad4e5941db7f7e22d16fb83f7b75792d0a476c299d6f3a8ad0a2f18fa3642c0e5bf731ee978b0ea677d177b28b159a7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd