Resubmissions

08-07-2023 05:20

230708-f1k3csdh2z 10

04-07-2023 12:39

230704-pvw24see5t 10

04-07-2023 12:08

230704-pa7ccaea9y 10

04-07-2023 12:04

230704-n8xecsea4x 10

Analysis

  • max time kernel
    159s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-07-2023 05:20

General

  • Target

    https://blackcanyonveterinaryclinic.com/wrist/1drv/1drv/index.html

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://blackcanyonveterinaryclinic.com/wrist/1drv/1drv/index.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4136
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3b7e9758,0x7ffc3b7e9768,0x7ffc3b7e9778
      2⤵
        PID:4480
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:2
        2⤵
          PID:1312
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:8
          2⤵
            PID:4224
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:8
            2⤵
              PID:4284
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:1
              2⤵
                PID:3648
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:1
                2⤵
                  PID:1192
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:8
                  2⤵
                    PID:4268
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5036 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:8
                    2⤵
                      PID:448
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:8
                      2⤵
                        PID:2984
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:8
                        2⤵
                          PID:2888
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:8
                          2⤵
                            PID:1016
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 --field-trial-handle=1268,i,6996091667830283062,14962002265849952132,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2748
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:4132

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Discovery

                          Query Registry

                          1
                          T1012

                          System Information Discovery

                          1
                          T1082

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
                            Filesize

                            26KB

                            MD5

                            e12869e88698a7ccdef897c661e3729b

                            SHA1

                            bf336c35d34e775e29c50168b351de5b041690aa

                            SHA256

                            94f584a17bcf5868513c7e0b8a7085df161aac6fc6deef8907d1579ed8312899

                            SHA512

                            22bcc26a6e962b56fd128e01d5fadfb8ceadcd492ea4280bd1906c0bc1d39c647685aef08de313d029b61fa3d853ccde3a0ca42e3f986cc2f46a5515f77df7b4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
                            Filesize

                            1024KB

                            MD5

                            f9549a66a0a74bdca92ca4fc69ed058e

                            SHA1

                            51711306b3fb526ea8482c3c140cef02f2978c6a

                            SHA256

                            7f1d0a1d627aacccab2d75bc0e6969eedc80f40092f7a1f1c509181880d31a4e

                            SHA512

                            a22f082f65497e08b657ebc5cd790084e6b88c9108e2118ce9233fbab9491553f9174883be08fcb8def79092068cf777f2b47682fd7388e4f64dad4654e29ab6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
                            Filesize

                            1024KB

                            MD5

                            8e326f780affb62c112f464c3bf20f29

                            SHA1

                            bfa7836b93ac56bb4ceeeabbc731da622290adde

                            SHA256

                            02a8cf87728c73ec5a8d9f649a7abbd1426057d86694e0cb9b1ce8afac512f7f

                            SHA512

                            26331f8626ffa55f39d800617f931e6b9d4ed59eaeadea3f3e074ad2bf332c9f10db07696e1ce99cfb4b3dd9cf58cf6ed48e4c77551bed3e8356448b1baa95f5

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                            Filesize

                            696B

                            MD5

                            31660fd1f9722f05944e024210c979de

                            SHA1

                            e92ae2d6ff9147a27327153852da877133cfc130

                            SHA256

                            0d6c2a835b531a867b1888f292ff72400b3f1972535477d8527960e8cb1c8296

                            SHA512

                            557ecfad8f455ba3512cf9875765f7618993b64573c599142155751da49f3581d9a8d7fe35f8dcd28e3a05e1cb8b89e381ffc863313553f257a312613db87410

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                            Filesize

                            240B

                            MD5

                            dd4fe26f8914ad759c5c6990f26c5ad5

                            SHA1

                            5411f5c17a195b9892d3eea2850989b1e6ba7ab2

                            SHA256

                            fe85ed2a7450750aef1cea11187deb3f4644b4a0c4c7da827be75afc39e1a6d4

                            SHA512

                            5a8fe2446d1e500147f75c66278fe4bfe008555e5924a6641b22b3c2eaaa5cb1601d31cfd27e33c0a7708c801db5c55839691645fed4881ecd07572a3f3acd04

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                            Filesize

                            4KB

                            MD5

                            4d96185ec4d1d663f0d4a288a3959431

                            SHA1

                            135f5f203dede6125a99a2c8a2b5a61158ea5361

                            SHA256

                            0fabda952b4c693030e3bd690cc85c2d0542697f684954c73708e236dc492e44

                            SHA512

                            1e169b8aba00c76bf2e81c72cb99208d698ce0b2923cb2ffe24614ea2a36d530a55d4052d20d2c2abf9e4e30debc9837c94762937a9f539a313dda9e66ff6196

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                            Filesize

                            4KB

                            MD5

                            fdecc8de04e82dfe106da3b9ab04739a

                            SHA1

                            c136a9bfde9e199cf747bb364c9d82e76c324d3b

                            SHA256

                            418eea197d36bf86c07adaee6a6c432378f093d9547c21f54ee6b9576ba44981

                            SHA512

                            8504d023def842454fc776c3b0714b39c1644c2582fbfbe7b1fffd18a52b442002f752bb538de8bcaab6fdc0428b9bc306749341d6a9b8facd6b0282a58ed328

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                            Filesize

                            1KB

                            MD5

                            0b633fab6c8e4f0938d849b188ae6ed6

                            SHA1

                            331e03596c726228dc60a9aefbc9353cc59e4317

                            SHA256

                            38883b23578a1756220fdf9fc94833fe1814302b176fcab41f0d26461d14d4f3

                            SHA512

                            1227557cb65046051d9f920e77a488f3a5755140660e808ec62b27d52ddf885959cad6f0b95f7becaa69369b6666b7f6267e71d0fa3aeb040bdf4d7d83a02c75

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                            Filesize

                            1KB

                            MD5

                            a7a102323547a06de568dd739f5dcdce

                            SHA1

                            97a5ecf7e3d9a378f358f48a023025cc566cded9

                            SHA256

                            49b95590015c1cdb46ccf2beb7d4f3b89bc1a91c4c4e4ad1fb8ab208dbcd1037

                            SHA512

                            b210dc13e1ca03f67cf875a6c727f6ab2dab2bafad011dabef317439d1bf869b49a175083158dd9e9b9d806916ddd3ff2d9ee81cefdcbb881b8fa55dead61fad

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                            Filesize

                            1KB

                            MD5

                            7394f9c793a4893c1219d1610289da04

                            SHA1

                            f9ee056580c2c6c16807e2521dc857ed4e1de579

                            SHA256

                            80517f603d3dfd35a98a9e002ba7b51d8709b625280749a33cc8910003532db8

                            SHA512

                            1262423fac2fe05a1e413b1160844e002aae6d50cbb932d5c9b1344085a4ed68bd3e50d3b7655489ed70094ca203a661f7602bbd814fff62e4e21db8df6278a9

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                            Filesize

                            1KB

                            MD5

                            5c799dfdecbe4b66eaf548c683220e7b

                            SHA1

                            943dde508b4218383e2d78f7e01f3eebe7f1d1b0

                            SHA256

                            22b440323f6df09be5e8a01107876f782f5e57d05fc1b471456787c3bbefc492

                            SHA512

                            6fc9b7bd4cd112fb7263b513d99ceac99245667a277df1d07898c7129a969f34ab5aeb03c2c4e85ff52976bc292d8970c6e0b47dfb59011674752ceafdf762dd

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            b810e93a54a7d9326deaa5735c772c0a

                            SHA1

                            ed94e13308dbc5a4f82614126cf141a5f635de90

                            SHA256

                            4c87996ca100c805630c37539e13adc542ef881d9d47d3d02cc9aee14e304410

                            SHA512

                            5ddeff787cddb485e4ce27f47b26662cdb31973f439d551997198b557cff83507ebb73227baf8bd53cef3e708a339ad7b3e3084de2c01b9028c35b1ba224b760

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            912a43db7cb4e3818de8de1ac2eb7dd1

                            SHA1

                            6bd1eae37299430228bb47f0e0411559f76adf8a

                            SHA256

                            8dee93d35de0fc12c0f3977368152c6b2ab3d756c5b356a52b300ffe71905bf3

                            SHA512

                            694e295dff6902b2f88e351069d443751451eb68785c167685e8d2025713e337547346b0b0eb44ad89bd60be1f0e474c7c5a0f410dc7c1494dbba54d4a66c81b

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            2354bf4abc2bb786ad954b57b975f45a

                            SHA1

                            fee2500f2d9b04b6bcc1dfbc1e74d9f268423584

                            SHA256

                            5cf6901a02f9f242dacebb1770a3ae6f22a053e16c44fdcf237e1d328833dd72

                            SHA512

                            e993897fabe519e28e2f95676ec95199121afbdad46287db33170430e9edcd84fc3caaecf7e79aa7093dbdcf0a2bd3540d5c407a1d6e780769e18b7763e28f4c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            80a69db8e3549e82e8e28dca01942b67

                            SHA1

                            72d3122a035789bb77d52848ce5937a0a44d839d

                            SHA256

                            e65b441d16550bca236c8012d85f34ae86cead557fbf7fd5b4087f6175551346

                            SHA512

                            bfcb91f18f10277a5dca72da59a59f0e2530c74b3cef3804370a01ce5f24fae2b7ec350277bf3f0391967905c20b3d978dd58027c6b682b51e7f0bafff3c56e4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                            Filesize

                            15KB

                            MD5

                            a6ad83b6454832094a382b96947b8711

                            SHA1

                            e3b3c65a5fa920a2733143fa17a1cea9961fe62f

                            SHA256

                            b13f1bdf5f680173a59e727626c124eee90baf883ab710d7ccae18cfcdf2a565

                            SHA512

                            e4452750e90010fa8feeb2e0de7049330dd7f8258ae5858e9383395d7c75f5ba69eaddb5b3b58099296c98cbf4eb5658d73763476dc060e5eb86e6f5a7e1cacd

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                            Filesize

                            172KB

                            MD5

                            f40a7dbd149bbcb4acd15501199225c4

                            SHA1

                            c24b6c2002a50ffbaf35f21cc3871bfbf8dd191b

                            SHA256

                            0552a9ee244975db56861f557b8ae2f0b782c69914e577442ef0919e95003716

                            SHA512

                            fa7d0ac8b78031cf2bcd99234e84659482368dc18700fa2330c3930dd6177e2e279bb65c1953ded026cd491db6bbc0feceee718e16b459c64827ecc711f398dd

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                            Filesize

                            103KB

                            MD5

                            3fdf995b2adbffbeb39beccf9a767a68

                            SHA1

                            54cee0df1f32ede004f69e81bc4a81b8d172372e

                            SHA256

                            ac5b634b8096ec863b9b4f622e798cce32316afe4d05c7d2b1cdb621ab36c466

                            SHA512

                            e038a66190a1c88f339f4cd32b6dbb99832f061fed004b591f1c682bccd2812f5ebe9f6e308d9ed7ab953e399512e5951bc151abc48f73eba0549902721362a4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58a870.TMP
                            Filesize

                            98KB

                            MD5

                            633bae4caf2e28bab14f7fdc6f39da1e

                            SHA1

                            e50dd9f2c31c0c4a244448b286e0cc356d751a5c

                            SHA256

                            e5f88d618cc4099a014cdb3dfcfddb9946cebf2b308f983b5df8bb43475a0fc5

                            SHA512

                            cb1eb977b3df317ea0cab1e3a25ac480aff5d2c70ee7f4b746903d1c34ee6a33f24e2fe9321547dd7cfd2771e82eb2118b2a2d314165c588eead954f75034b6c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                          • \??\pipe\crashpad_4136_FCHJKONGPLJKOAMP
                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e