Analysis

  • max time kernel
    600s
  • max time network
    580s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2023, 21:19

General

  • Target

    https://5w11mq9opp.s3.us-east-005.backblazeb2.com/uECQHg5y2S

Score
10/10

Malware Config

Signatures

  • Detected phishing page
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://5w11mq9opp.s3.us-east-005.backblazeb2.com/uECQHg5y2S
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7fff29a99758,0x7fff29a99768,0x7fff29a99778
      2⤵
        PID:4572
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:2
        2⤵
          PID:1204
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:8
          2⤵
            PID:3824
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:8
            2⤵
              PID:464
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:1
              2⤵
                PID:1764
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:1
                2⤵
                  PID:1608
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5076 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:8
                  2⤵
                    PID:2300
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:8
                    2⤵
                      PID:3916
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:8
                      2⤵
                        PID:2700
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4356
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:2916

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        168B

                        MD5

                        7e78c31573a5fc8bfbfa649f6d7459d3

                        SHA1

                        1413be54c56dd04f6597d2b171b82a48573faf9f

                        SHA256

                        b3fcb1e15a743ebeb8bfd3e9f74a3681c6e25e9ceef6840644c2bc604a9fee25

                        SHA512

                        3c25f6270caab5dc03590a856e26a064c050f294a8e27d623cde1a0e8fb86acd3312f7d144c5f4a70d93664e1d72af92d973bdcf1d7a9ea04375f320e5af6d62

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7039d706-6dac-4ffd-89cc-3237342a2871.tmp

                        Filesize

                        1KB

                        MD5

                        c5c518f83f744c890620e328cf9e21b2

                        SHA1

                        0e629cbf560c41f018c37926ac18fd1afa4a7ec9

                        SHA256

                        0a2f62adde483801175efc4e643f07d09c46b9d7c261427b779f9f0f025fe455

                        SHA512

                        67c4dc433a96f84aadce2658d188099e5290ec07559b80b6cfa098e0c3ed51cd2caf9860058943862f014aa0fdb01f59b0808de6ad76c6157333b33dd7a0265c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        7bcb5c380122be4b32e821d2b73282b7

                        SHA1

                        da7fad6a4f1bee022a5d3cc96369e6f75c047a41

                        SHA256

                        4e92e0522f3eddcdf7a42c6dadb58d6476babeafdee8dc50c9c27a9e4779ec2d

                        SHA512

                        f80864fb4a4e5b2961edc4f399e3e93cb0b57441da76ca5783312657c27a4763e7a4857e9d61c59640dc7ef734bbaaebd2ac27cf8ce045575e4bb6d6278b2979

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        68c3513722831a2d378f2af3fed95c24

                        SHA1

                        f902f8966cffd419aec96754ef0b18c728c2433a

                        SHA256

                        ed98cd9fdbf138e37d064b67bf4c79216eb25f7b6846cf90d0b9caddd7ac6750

                        SHA512

                        a3fee60b02f830064b32325f5dad552f6600c30edb6fb412d76896e66ae767674c55f8a35cffd97fb213944faf72f7d9547d4a64cb24c65f5d0c4a27627368e1

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        ca9f3af8bfecdd620224bc28c269ed86

                        SHA1

                        32dce357c98ff4abac83f6b0c7722f0c1734b229

                        SHA256

                        912cc2d417985e6efdb00e61a77a0970f81cda291470755412a9f08774c72c81

                        SHA512

                        0991286a2215ec564d1e1eb8333edd085a6a1d330ab80d26bcd431a582bf0e49f91bc212219d2591ac5b984c0c89be1e4111e83e6865c371f3b10d692d041630

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        0c85a519a57ae219a08b6d01048fec3c

                        SHA1

                        0995707a84d7bc7b29601c5cdd81c3f65209aaba

                        SHA256

                        7361ee987ed19730dbf031cf8ce78eb4280009f315867f0fc3127c080cc938a6

                        SHA512

                        899061e2e7719af9ba4d0e7c3ee2411f3883f8aee994386cdbf5d15bdf09f153cafdcbce58a78829fca5f4de05132c428505bef017ce72577eb9ee985ead0ded

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        3d5459d4ca92afde23339bcf2566bc7a

                        SHA1

                        ee42931e7fb45e22cd7de7b556b0581af6c8000c

                        SHA256

                        9ecad312d1e4b94917e0743559a3a8e432ce8a9e0ce7e80c2eaa1ad5e6b72e8f

                        SHA512

                        1f7252b69127245e1026b47a44e9819a641198b51c309f684faca0924c9bb52f1de650dac33d46c21eab31e961854b62f16ba97e4080749efcad5eb213cb5b7a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                        Filesize

                        15KB

                        MD5

                        78d4f4df602b17cd79643891298046e0

                        SHA1

                        39a272f7ac7787a01a425a3b0eae43a7b193eed0

                        SHA256

                        97e9208da2561088549d67db2fecb60a20fdf9d7a2dad59bc62cfa40a9c75ae7

                        SHA512

                        28c298a293dc29d6445d324e44aaa5390378e53ad4715220a903d8639d95f16f342817e9d079aeb471bf306d827c5aea5195b76fca429a5e4c8487ccdcaffd47

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        172KB

                        MD5

                        c3500f2e162ae6985097ad3ba1c6ad99

                        SHA1

                        55030daab5f48c0f59c9835ead721af93d9c2f93

                        SHA256

                        903b253695df00e0c35b22a5d443d51e295cdd6762510b90e51a3a69c2ac2677

                        SHA512

                        aee543d5cb879770711ac3e6d5a03d847823eafcf3721cd4ffc584dc65699fc67a185f15982b9edc46c0bc96e6cec81e0fdba4744d7699939b8a058db1af3f41

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd