Analysis

  • max time kernel
    299s
  • max time network
    299s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-08-2023 16:29

General

  • Target

    https://accounts.google.com/[email protected]&continue=https://policies.google.com?rfn%3D1691372591309

Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://accounts.google.com/[email protected]&continue=https://policies.google.com?rfn%3D1691372591309
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:552
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fcf89758,0x7ff8fcf89768,0x7ff8fcf89778
      2⤵
        PID:1860
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:2
        2⤵
          PID:5004
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:8
          2⤵
            PID:3780
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:8
            2⤵
              PID:4208
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:1
              2⤵
                PID:2172
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:1
                2⤵
                  PID:2616
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4672 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:1
                  2⤵
                    PID:3804
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:8
                    2⤵
                    • Modifies registry class
                    PID:4776
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4684 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:8
                    2⤵
                      PID:4172
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:8
                      2⤵
                        PID:3520
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:8
                        2⤵
                          PID:2832
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=832 --field-trial-handle=1912,i,7120440896041479506,3752646357104762735,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4800
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:1468

                        Network

                        MITRE ATT&CK Matrix

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          408B

                          MD5

                          8bacc244556452f943c5af71bb1c1958

                          SHA1

                          877807b0332fa91d2c4c0cc49076305c10994ece

                          SHA256

                          f37293229f84df5dad11e47b8371e73d7bd130cebb724aee92f231ea8a626653

                          SHA512

                          558109384707c890ac53b5e0c113f3be00aa4388101936c8cf039731036cdcd868fb5edadb7287927e0520c295af6a69fafb32f979d8f7ecc18252c6b34e9b62

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          08f5bfd9c4b382c957f57d9a28881f90

                          SHA1

                          99e5fdb23409a060e8117d664535c23190357609

                          SHA256

                          0b2bf7a4fd6cb1ce3601cecc6824aa767da2ad2ec31a94c028cee651a30a58e7

                          SHA512

                          74e195e115f35c3b52dde99dfe48d1c0ab45147af60943e1105a5b050874c2edbde4dd819eaf0c9ebd364808603eca62b9a0508a3bc71bda28d5c2d27bfc44fd

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          1777e6db917f02e573bd0ea93e587a1e

                          SHA1

                          59620c1a2901b28082625f7ce94d1522dd2e365b

                          SHA256

                          c93db8b5b778f3fc3bc5ceeee2e677ca943bf9db1a68d4ebe22b0c083a2d8009

                          SHA512

                          88db5707353e8d19e6adbf3de15495796764b12063d5f37b408d593a5aa3eb65abce023201c237372982e1940216f4a1cc9e0b52c99a03704e5c47e9713fbf2d

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          4d8090be5d8eb6cb8cf4d8b8965149dc

                          SHA1

                          80061f57240cf0282a2820f34436972b2d447c30

                          SHA256

                          43c1bf37efd441eb37037685cbcbe2f7b72adbcfceab7996974ed4d4aa66ff90

                          SHA512

                          57c881c8eccc9ae244a93af77047c827c0a40b65b20de58803597e96343cbe37305e8c32ba1140e93a4349b9c4a8b197b4b0271eb8479bd672b93f0f7dce0c38

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          371B

                          MD5

                          4b71d63f1eaed1f3727befeee65b9e22

                          SHA1

                          20ed5397e86da4df37f334c739d102319711c8d7

                          SHA256

                          96834bdc33bd9bbfad41a0dd7529b9e8a065cebc2644cc1beff7a68d18c4f2f9

                          SHA512

                          bb4b0e265cb609129686026bc496e7fecbe966721e2a5e1f1685a7a2a5fb2640bc82c9628d67216b9aadbb492a8adf53165649aaabf47eac4899666e4ab58cee

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          371B

                          MD5

                          6a1450963ac6e03d65d18cda40f1aefc

                          SHA1

                          b56a8e525675755239a3c8f51506b3e26453f509

                          SHA256

                          09022fa89f6e091a39d99640e6f481472306105d9363ad8257a97d815f095ed5

                          SHA512

                          300216cbcc44a92b79da2d05868f96794eda31a4acffd78295406484b67d93073a28552a13a77c148cacacfdf9c91dfbee5aa7efe797ad3664c1ca0db32e7fd9

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          371B

                          MD5

                          9226e46aafe90a968b4c3c72957c1ade

                          SHA1

                          9cb31b85e1bf2e4e53fcb3c47542f37637432a9d

                          SHA256

                          567af2726f9091ed478e7e2ce066a430cc61cadb13870d0c2039ab4e089f92d8

                          SHA512

                          146bf40581e545297395475e6ec21eccfa787856b36df4663a9956329105e6e479fe0527334c4cacd9e354ed81e402875ae1fb7c918dd6261af62a5b206402a7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          371B

                          MD5

                          dd138239fe16430f944f85957088ac15

                          SHA1

                          b1170c804bfee9e26060188447d4feca785b1b81

                          SHA256

                          2a8bd8f724a2483ee4cf7c9f35e2aef54624c393bb198b34bddb0df18cddf8f6

                          SHA512

                          e4a380516df746fdc2be91519001deb5a6e9444f0702c0a35edbdc845e61f59864baf9a84e138ad7af9b4087e09bef7a545452f9aa40b6725b3aba09a217db07

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          5ac4796bef50cd38c8fda9438850cc61

                          SHA1

                          c346f670b6376ef1c4658955c91749f2f34f5150

                          SHA256

                          2275fa032ff10c8c05401846743ad48e4f3697177c3b9c9ad0345f1f071afd9c

                          SHA512

                          08a9ece8d4128983f801995d6da0502f7ee6c579ea86409aeb51e007201c545b2e3ceaec1f5757878dd9bb50733f1ab849899add7b0e65ca49cb331c34255a33

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          87KB

                          MD5

                          1f7417bd38c25bc3878cf8d3ccc6d80b

                          SHA1

                          b3ee2effc26f9664fc606cad7fb72246cef42268

                          SHA256

                          25a858190140ac1397c1a7188692bfb543bbf5e9a966968dcf69e6eef0611b89

                          SHA512

                          25402872491b87a9da168e931ff6b91ffc0aa3deb4aeaf8bf65bfabcd638cc4506233b0e596c111db4c3c199ee14da1c59d4e9bd621aeb17d15e261779058349

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd