Analysis

  • max time kernel
    21s
  • max time network
    25s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/08/2023, 15:13

General

  • Target

    http://myanimelist.org

Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://myanimelist.org
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff936a59758,0x7ff936a59768,0x7ff936a59778
      2⤵
        PID:1176
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:2
        2⤵
          PID:1120
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:8
          2⤵
            PID:1520
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:8
            2⤵
              PID:2884
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:1
              2⤵
                PID:4164
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:1
                2⤵
                  PID:740
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3812 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:1
                  2⤵
                    PID:1816
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4336 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:1
                    2⤵
                      PID:2540
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3452 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:1
                      2⤵
                        PID:232
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3404 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:1
                        2⤵
                          PID:4400
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:8
                          2⤵
                            PID:568
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:8
                            2⤵
                              PID:4016
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5780 --field-trial-handle=1900,i,18109777409713224433,878775605848529411,131072 /prefetch:1
                              2⤵
                                PID:1412
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:2244

                              Network

                                    MITRE ATT&CK Matrix

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      1KB

                                      MD5

                                      b6511d4313775a3ef90bd356dc632e3c

                                      SHA1

                                      a1185dc8aef996a143a872564f91f042f9a98df9

                                      SHA256

                                      c8b888fcea9adf1d9d326fc11dde7aaa02b209b92dfc879e2688f341c4707cbf

                                      SHA512

                                      ba473ee117e45ac30a53aee6d788b33d2082342bab094d7275df04750dff5cbe1f2a0563f4914671eaa7c928b1abadf089353b949b1b4e2be82b858bb02efce7

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001

                                      Filesize

                                      41B

                                      MD5

                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                      SHA1

                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                      SHA256

                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                      SHA512

                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      4KB

                                      MD5

                                      fb257093e5eedb84155f9b363d4fbeba

                                      SHA1

                                      809290caf56887077d26ef137dfe552a983326c9

                                      SHA256

                                      7a1c1f78af6181c38c712fdd42955591527d7c236856afeb0e61f5936e4cb28b

                                      SHA512

                                      175755344daca8ef8db213599dcbd12f80a3bde4c728ab3d4684fff92942ed90ce538f402c942ffdeb0078bab4638ec2abb0fccf4a29959998aadee708534d48

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      2KB

                                      MD5

                                      70ce500d1159a87e7fd863c709b84ee3

                                      SHA1

                                      aa9810703cb076a45a74064ca3fc050c8301b641

                                      SHA256

                                      98f090a56020aae62621e82c6db8fb03a60decda5fe3170f8b0d273a86b48870

                                      SHA512

                                      b87fad61c2382e7a0a92ffb8d4000793480bb3647a407f0c4c2fd58d0dc32e00218057876712585cc2c9381bdf68a436138edbdf839a09c9730b5973f73c8d40

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      2KB

                                      MD5

                                      0632344b231288511b46211cadf9822c

                                      SHA1

                                      0b88ec547126acef678f24618fee68ee827d835e

                                      SHA256

                                      e61b7dc6543bc1919e3ab3e6b51082c816515b7605de62b86a0d596602693153

                                      SHA512

                                      3522ac6693c01091641d73509169f422bd444cbe3d43a3b91f89a15b57cb7ffadf980289edee14efe44cedef908b306a8c892de3345972d80c2f0c7e46b29d1d

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      f450ec77ba907669389ba14694ac9fd8

                                      SHA1

                                      f7a7173bac63d20c3a0b38a7d2a13012b1a6a7df

                                      SHA256

                                      3f49d97fbf137f79dbb7f8930d215558f0a01b3e269ef146ce993d3c34e08bf1

                                      SHA512

                                      85bac67ac3777ca22b83ddb34ed6b918473eb38e46c9b677645ba8be84549112291709bc1c0f04e77b81947b096f6cd4b2871dea9568907add24a9728b912597

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      5ccaefe6f6f0fb05761a51a33ca2c7f1

                                      SHA1

                                      a3c439c596c0b0b041ac386f3e76d61eaa754d9b

                                      SHA256

                                      d594c4a76b14eaa59acd8696d86621c0f3a0c982f819d9bbad8e0e43766ddc51

                                      SHA512

                                      4914efa226447c7a75e22d99004bc2c30a85ce425235b11fef7e2269ce9d0841a4c87eccd8bd88f290a98b7c5ce29d10878204b81b57cc735305111aa9a10d31

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                      Filesize

                                      72B

                                      MD5

                                      d0968db09e8a45631e4d7ebda043c8bb

                                      SHA1

                                      358051b2854fced817a0709315f10a0283d4e916

                                      SHA256

                                      3deb30c36df477da849e4d549e37ff412b5893eb47cf5d8f42180c87e401f8a6

                                      SHA512

                                      c6efcdfa0b1a163e1eaf5ec22edf26824b2278100846feb43dc93b7e5ecba315259204811895e7f002278df65934e349c92c4233ad153738c63e8f8af8f2e66d

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5858c9.TMP

                                      Filesize

                                      48B

                                      MD5

                                      1de63199b500c8acf9805abac4e2885d

                                      SHA1

                                      d0630b6a12c49f50b561ef3d2e6a15682ad69c31

                                      SHA256

                                      479b9ed5ac5da7b81cf42b1b20a019bfc679f52d77d8b9688e0ed4f3d432d7df

                                      SHA512

                                      0f842e6c860aaa0db6c3a144607861d9bd96237a3d1e4d1609b82005bca17531827fdc18bbc6fb989e27b32fd8beed6b5e119d1b19472a7e49b00e6b2e4c4a41

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      87KB

                                      MD5

                                      e2ad2ef51fc8620a40bdf9ea04ad5c56

                                      SHA1

                                      c3e172a0fe2fb858ac64e25a026fb8413854b4b7

                                      SHA256

                                      c289c6fd708906490da3312c087e47ed569efc75b2e144d4618f8acf945c8a72

                                      SHA512

                                      ae5fa1c08dd806f1b80e2fe9d61c2c769b98870e5afe3326eaae97d09183db519996c440fcfd2ba34a66785fc577e86a092c854ec2583f17f7d7432f253ae924

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      87KB

                                      MD5

                                      0981d41fc0f39bf74a6decbd621fc900

                                      SHA1

                                      be26cba5350dea123a59303b33654274d86c7a19

                                      SHA256

                                      e0d90ce9b8d263fafb94fcbeff15ef2c6da7c4530a77ee89152da09191d154e1

                                      SHA512

                                      c0745483e7d9121ff02160b071e13024407e409612889f03c3c7065c92180dcb8fb2cc898777e5f76b744013641d0a170647633447c1d50ef7c307ac3fa92c0f

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                      Filesize

                                      2B

                                      MD5

                                      99914b932bd37a50b983c5e7c90ae93b

                                      SHA1

                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                      SHA256

                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                      SHA512

                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd