Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-08-2023 00:40

General

  • Target

    https://avlantegroup.com/privacy-policy-2/

Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://avlantegroup.com/privacy-policy-2/
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf059758,0x7ffdcf059768,0x7ffdcf059778
      2⤵
        PID:4568
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:2
        2⤵
          PID:3052
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:8
          2⤵
            PID:1068
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:8
            2⤵
              PID:920
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:1
              2⤵
                PID:4960
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:1
                2⤵
                  PID:1684
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4620 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:1
                  2⤵
                    PID:1516
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:8
                    2⤵
                    • Modifies registry class
                    PID:4720
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5364 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:8
                    2⤵
                      PID:2424
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:8
                      2⤵
                        PID:2176
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:8
                        2⤵
                          PID:4640
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:8
                          2⤵
                            PID:2840
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:8
                            2⤵
                              PID:1360
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 --field-trial-handle=1784,i,17090040351647210303,169340972229503807,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4680
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:4676
                            • C:\Windows\system32\AUDIODG.EXE
                              C:\Windows\system32\AUDIODG.EXE 0x510 0x154
                              1⤵
                                PID:5052

                              Network

                              MITRE ATT&CK Matrix

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                1KB

                                MD5

                                af1bb12426f5e07c85327055ea0b848f

                                SHA1

                                9b7c751039546aa50ac53f277ad4dcc34c3d1fe6

                                SHA256

                                ec65441a3c12e92ba703870be07e17de9d57f5d5373e7755730327c15c98af97

                                SHA512

                                89d582ecab849ca5991eb2f49087b3ce7a75b6fd04e57c52259a13b3fe577492b2b8b03f68dd9ade68bd6d311e4c54c6f6f3a0ec5fa1354c1d3e66f1bc5491a7

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                3KB

                                MD5

                                cbbabb55b80b4119957d3d8ade59ea72

                                SHA1

                                85f35ea86610d86106e5357bffbfe3b6f8e43f55

                                SHA256

                                7b9afc058411ea164a24ee88e5e066e3eb75dcad9e534db0e0e182f6c2aef928

                                SHA512

                                bdc77b64de189ae2d29ef0898b1cc1e70a1b3db2120d5988701f7c531751172348bd1f1ae0f1fa7e0bb8b53d7f3db6ea52801d2ad03f4a688caa51b0199dd5b4

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                3KB

                                MD5

                                4ddfdbec3362c483f31c58ae83497526

                                SHA1

                                f0709aead5e33f24c3c691e7ccbe6176382fc09b

                                SHA256

                                c23d4b8a5fb8afb536043ff567cc703717ac30439ebbee839ddfcba8e5d3cd7c

                                SHA512

                                6c0c911a50bb840efd3b88156e6c50a59c0675edf47b3d3cb53baf6a5b6da1154f3c5670ab6f01becb46c2bc082863706bd929c1160e75a5bd4ed5a521bbfd75

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                875B

                                MD5

                                dedabc6b0072ef694ad6d48c1a973981

                                SHA1

                                6bd69fa113409d0f0c56312d21a0ce0e67d7adf6

                                SHA256

                                d91ab5d7f99b900b1f364f8a05f923e344024a8e00a81992e870ba6d2b18c49b

                                SHA512

                                e913f3c3da722b24690950d90b9b69e78edc4da5962fb398bbfc111b86943b5fb4b7e0b3d5685209964bf9c88d066e8a7b5889d932a303c79c29e501e4cd4054

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                e5286ebfd93eed5fab9a1d9806494a73

                                SHA1

                                23bf09befe5078b515a18677eeb9063e7440a31c

                                SHA256

                                f3d512e686f4f907a5a7158e79e7210f2d803cef128082c0644d478ae41a2785

                                SHA512

                                4d0b1217da28bf68478ecb0612e2356654c5f5ba67a9a4b8345b65f818c3a2a3e1ae11629a0f76630b65fdaf3b68707cf92038b23eb3d1b7c458e85dfebd9575

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                a96426bf51f442d3489f031f54b03809

                                SHA1

                                87549f6b63b8fb63500ec6b83319ee86f35099a9

                                SHA256

                                c8217cf1009ea394de5585cdff4f7105216622996cfe8a265089fe615b1e1bfd

                                SHA512

                                16a091baf0f146b0af34aeba51f394a44105f7d839a694e7366b1d277e2ab61916e767db04a8e1d02dd95a66c880a2e81696b58130b9cc9ba9489da3eb0afd2a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                cb8ff47a4cb818c41fc8bb415b0e93d5

                                SHA1

                                13f10152cad16776501b9e534752361f3a24559a

                                SHA256

                                ca2a67fb2738e15d566f8cc046ce1ade30055f69b6abf06f4706f03fac077f0e

                                SHA512

                                f52432dc86368c54d56cd70f9a96d76cbd7857974f27f4baf8e9b019531c4720e4d0ee5bb68133e64174b2af6fcee50ad2dc3a4cf0a650d63b4a886e46643883

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

                                Filesize

                                74B

                                MD5

                                73a465dadf426a1816e6124332dbbe2a

                                SHA1

                                9016ee293d948b12d364e9eeccf7eec06a1aa032

                                SHA256

                                60ebfbe19e0b00485e81b7fa15d8988ac37bc2cdfd734311d3ee4b24f562a8bd

                                SHA512

                                e55d2a34a093562bf8cf9d051dcb7b1bdf459a86cdfde578ece91f76ec18f7fd1007db5c93dcd9864fb97dd7d5d7581ec6bbfb0d0e867e04290bf434935725f6

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt~RFe5803a5.TMP

                                Filesize

                                138B

                                MD5

                                053dffe407513b62330c2679ca04437c

                                SHA1

                                9177abd732269df11b081cf709a61399dedba3a2

                                SHA256

                                ce0a8be9d71bc7cc89caea16303055f7bd0be9fce66c049a5530abbc2428eca8

                                SHA512

                                93187c2a062a4e7013131207412541ce690af68bfd3b5f19a57454fd2263807d151456748e8980ba617f5afd5c14e407d0966746ec605d3eab8bd53cbfbc12f0

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                89KB

                                MD5

                                a12aa65aeb58611be9471c89f9215810

                                SHA1

                                7a8d5de258645bfd43ee47240df98251b2419b09

                                SHA256

                                e44d27c016ac537e23c9f499de9f0509db1b4a4643d4c6d3076c17c0a84b04f3

                                SHA512

                                3944e7e27ea36f525bc2d3ac16fd18f2c6fbb7e83ff8b21c1b2242b5f916241cc07f6d09495f7f2c6703d48a8f8b70e5254047263e4401113931b8c9c1a24489

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                89KB

                                MD5

                                f9a2811d619b06ef9d55c3701d4c5bbd

                                SHA1

                                fa752134bc65af119e26459a2e31c082693541b1

                                SHA256

                                bc04c87e828eab80347534231461396dd139621df4caf088a643bcdf5b8f6516

                                SHA512

                                5c4e4729cc5b252b8a35c898d13b13f872732a774a276d60b4f57123d820c05678e8a410a2d31d4d08f57a73421ecd174f2ec9215c85fa4c3ce668c2fbf7be31

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                89KB

                                MD5

                                7dc539c6dbbabfed63759ba8a98948a4

                                SHA1

                                0e2a071369c64dfcad366b59a465cbf09471f5b0

                                SHA256

                                c5c30efa05a596e342afcfd8765139e0ef691793db61827ac2e183e818375663

                                SHA512

                                4bee584d8e8439904199f5a8474c7efc2e32ee56267c1cc0ed12ae662ca21d5a88243a46364869d91096168f35d9691bbe62ccf1efdaf48e7b4b3406db7c7874

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                134KB

                                MD5

                                3d4bc044cb0b813a03cf23430e71292d

                                SHA1

                                8bd97d24a1d71bf816e5c786d874a98fa1b4cba5

                                SHA256

                                1f0fc90414c8e50436be4c3406cda9205bf1d8ec4d20e5d596a857b71791e1b2

                                SHA512

                                ed8d79c4a5d02733cbaf86c16ba47de446b77a39e9ed6fd4cb4e1ac968dc20c947572789a927f5ff8e0a2a63f4628112673900ca61ab7308e641a51ca1f0ce85

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd