Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-08-2023 06:09

General

  • Target

    https://unlivingfun.netlify.app/

Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://unlivingfun.netlify.app/
    1⤵
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d68d9758,0x7ff8d68d9768,0x7ff8d68d9778
      2⤵
        PID:5032
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1872,i,5041511867636451639,15335663411657680515,131072 /prefetch:2
        2⤵
          PID:2464
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1872,i,5041511867636451639,15335663411657680515,131072 /prefetch:8
          2⤵
            PID:932
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1872,i,5041511867636451639,15335663411657680515,131072 /prefetch:1
            2⤵
              PID:3196
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1872,i,5041511867636451639,15335663411657680515,131072 /prefetch:1
              2⤵
                PID:2500
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1872,i,5041511867636451639,15335663411657680515,131072 /prefetch:8
                2⤵
                  PID:3664
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1872,i,5041511867636451639,15335663411657680515,131072 /prefetch:8
                  2⤵
                    PID:524
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1872,i,5041511867636451639,15335663411657680515,131072 /prefetch:8
                    2⤵
                      PID:4120
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 --field-trial-handle=1872,i,5041511867636451639,15335663411657680515,131072 /prefetch:8
                      2⤵
                        PID:4372
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1872,i,5041511867636451639,15335663411657680515,131072 /prefetch:8
                        2⤵
                          PID:3372
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1872,i,5041511867636451639,15335663411657680515,131072 /prefetch:8
                          2⤵
                            PID:1700
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:3852
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                            1⤵
                              PID:3440

                            Network

                            MITRE ATT&CK Matrix

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2ed79bd3-4cb7-4147-ac59-fa174913971c.tmp

                              Filesize

                              87KB

                              MD5

                              00a5c1e463620c5eae3d7fc7970c930a

                              SHA1

                              53bf5ed983b1024d7afb03a2e84119ca2973e880

                              SHA256

                              6c6fd285fb78ee88256c9a207be8a14d3d56b5944abcc1710ec9e649c8ad6001

                              SHA512

                              a4af2dac118557585bd0d9e6a54d053c08bb4f63d687a4b8f5e617c7aaad1c6d369d6f2b7408f3de6038c9a632c0f69ed76cc8ed6fab9b3d9ad85cf3c1561717

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              72B

                              MD5

                              90979ac3ee53f5127d8d27f37d5d5149

                              SHA1

                              3a4fc7ccad7ef4a528a10881127a5b102c124201

                              SHA256

                              0fc37f5d597aa5a3ed6379c60efbec0f0a97d2173d4335a81bc299fbcfc91020

                              SHA512

                              bfa95797ad20b9973aefe5300ae434b3172817a3784ab6c852b2b6ac0f21d6ce7ff589cd81d04f2a17aefec7dcf861824638441f21aae3a97c1c937fd7e585f8

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              0e7df839df779bf2a299d9f6153dbbe4

                              SHA1

                              e38e050909723dac7194ffc691d352c874d32c0a

                              SHA256

                              364ac71164877016d865261d4fa2d7d6415432210566a1aae40bb328229e2a7c

                              SHA512

                              cd1a04b3b015f69507b45011025315b52e2a1c643f0fe03b202d9a2dafe5399b7b902f46a40e66edf023e4c7982eb269ccae28719c4d2047ed3644f8cab5db27

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              706B

                              MD5

                              c421b29e4da9206bde234e7969ed5fa5

                              SHA1

                              de21c3ca5c23f2e941aad98475d7301e12979d1f

                              SHA256

                              f44c80f076d71a8ba3fbbb64f0ea94b83e04594fb3839ae25a126f16798c3bee

                              SHA512

                              d12654c636cb5b0b5ea33ad30d68f03bb1a2242264761aadee3bec72d196f9939e72de4ba74b8fb4cdacd060ed3c9a7b3dd49ef4596ec71c4c64561147857b4f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              706B

                              MD5

                              d1b66f2b73721b446d7d3a3acc5f46f8

                              SHA1

                              3f92631d38111765b7985682841877fb214dcade

                              SHA256

                              7fa7e0e8c7441c836ed4eee27231ffcc4fd5712068bf71a0cfddb16e8e740025

                              SHA512

                              fd121eb4886df17cf3c01b52b17a70afc9632f832567db2741936185ab2c9e99e36083f245d47ae6789ad92b9799b31801b0381251a84cda61667d9be85487cb

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              5f1538b83eaa1cc50da0c03ddf3e86d6

                              SHA1

                              f95502b2bac90a139e456d8aca022be9755362ee

                              SHA256

                              f8b4c8dc9c09ac4d235bbddb0fe9e4edc9b397f10acf5851e2f30ce0a091969a

                              SHA512

                              b7090e6595f0429ca4d5f1f4d40b835724e2672b9ffd9d07d6fdf9da019fd42e90f6a686da9419a4d1f649a3fb94c77849f7abaee9459a4ec00d162d7547925a

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              e8a2e9dbfbfe85c0a103cb52633bf313

                              SHA1

                              8590856cac6c09e9bae1185b7e1e158c2b281389

                              SHA256

                              271e5c1b566309192eb0608540c3211045dec534c8d99b9bda13707f1a7e75a9

                              SHA512

                              afcfd415d6e6458d4bc230ab10f894fcbe6149e5f8cdb23cd12eb9d3c89e059c9507c9ed6d1b38a20f9e883d3d3337d5edb6d7c898e0e2a92bde4b0f7f7177a6

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              4650b8a7c4f1c58e34e3a774fd790c61

                              SHA1

                              828cf77cc7d9de4e342c2bc0b2a29ba36a0c5cef

                              SHA256

                              ba754ac1bdf4df5b1a005241af5b9a3b8b9639a68dd72eef027ab1a23a2c7c1a

                              SHA512

                              8e899f040ae0cb2b970274549ca10cd6f37ce8c245702ad396dcd8fed603fe5c4c7648275991edffa79c724bf8f088eb4734819b389053ef0823009b6fdac899

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              ec02c77a1798a4043e15094f2a64b926

                              SHA1

                              989ad43c77716904bb3651ce1bb279f5db5dc07d

                              SHA256

                              3a16c84b7b84043956569649eb31a469a930bce2348b255d7477a7018b69923b

                              SHA512

                              088b1f8be33d18e6b3181ca30fca4979af68ad6c9440ba0965470a11210e3221a9c32c0ac3ff23df59f891180e8d7f1d4abfccf0fa0e955a6b429e7d7fe9d22a

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                              Filesize

                              107KB

                              MD5

                              a1251463c8f71cb07c24f9a4d2ead3b4

                              SHA1

                              6e6eb9906abf259cec6295bd9883c61d7668c130

                              SHA256

                              a8423787dd479ecdcfe83daedaacc503775807e53b70efd2aa09b8cb4b3b569a

                              SHA512

                              fcbde96b742bad307550cee46c6b42d2ddfa024dfd8e009f0c745586cfcf0c82f1d5444e76c451841de8488b0002c6ee165ac4e17ab96648d25cd32984fd3722

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                              Filesize

                              97KB

                              MD5

                              6bf12ce3ea567c58531585a94c145d54

                              SHA1

                              708c348ddddabbc4eab6251e4ae4d9248431443f

                              SHA256

                              42131504ea31b92b1272a2daf55c4825d0b3c3b0f255835c01cfab034193f1e1

                              SHA512

                              42a28a6574ee51984e2309d875cb1f6446e4e5c6577af5808a098346400fbdbc3ac9d8f387ef07a06a18cfbb641656812f90b38f4bfb2a9a112b933aed35f5c5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                              Filesize

                              103KB

                              MD5

                              d0d45abaa45274b986e7c373194893ac

                              SHA1

                              3a9067c5a4c5605af692ca679b4badfa7c20be07

                              SHA256

                              860fbdeb1e344ad3c2e86f23f7565034215280bf49a21faea11fb5fdff815b63

                              SHA512

                              4a7ff66158f684034d2b08b26d12e2760bc60eeb6b1af7b735e0b0346f3b6c7a2f7fddfe6e1f0d9ec02eacc1897bc3890e6bceae105e7422f5c5192b8bb734d0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd