Analysis

  • max time kernel
    111s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2023, 01:35

General

  • Target

    https://kali.download/base-images/kali-2023.2/kali-linux-2023.2a-installer-everything-amd64.iso.torrent

Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kali.download/base-images/kali-2023.2/kali-linux-2023.2a-installer-everything-amd64.iso.torrent
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff905869758,0x7ff905869768,0x7ff905869778
      2⤵
        PID:3076
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:8
        2⤵
          PID:1060
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:2
          2⤵
            PID:3320
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:8
            2⤵
              PID:3060
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:1
              2⤵
                PID:2204
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:1
                2⤵
                  PID:4744
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:8
                  2⤵
                    PID:2816
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:8
                    2⤵
                      PID:2788
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:8
                      2⤵
                        PID:3452
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5216 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:1
                        2⤵
                          PID:4108
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5348 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:1
                          2⤵
                            PID:4084
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2984 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:8
                            2⤵
                              PID:2592
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3292 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:1
                              2⤵
                                PID:4188
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3484 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:1
                                2⤵
                                  PID:1832
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:8
                                  2⤵
                                    PID:4960
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4636 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:1
                                    2⤵
                                      PID:2240
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2996 --field-trial-handle=1884,i,11116765708042144743,6341937296412935558,131072 /prefetch:8
                                      2⤵
                                        PID:788
                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                      1⤵
                                        PID:800

                                      Network

                                      MITRE ATT&CK Matrix

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        720B

                                        MD5

                                        08e266acc68af84ddc896ab3cbc59239

                                        SHA1

                                        05420f5a70fd96c7f960c34b5b0bd94ac2df71af

                                        SHA256

                                        5026cf50b7be863646b09eb16191f903a6915cf8007f33d82188533fcdb5b249

                                        SHA512

                                        a850e159981bbeb5ee2d3a165428180a39957f10f78beaa3698fa20cef4bf1edb9bd69ef445dcb48c4a0bd0ff73aabbbf2f93900bc020e80cb6b6a632fee918e

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        1KB

                                        MD5

                                        b4acb4f4766637f5118a0a3d4012b7d6

                                        SHA1

                                        9820f87151a4ff0e073e9cd2f22f27d7e7a7ccdb

                                        SHA256

                                        e8becfa4e5d170a4bd3f9aefdf94935ca19f32a686a29e9bedb3936ade72b947

                                        SHA512

                                        135a93e6a9e9456176b7268daf318276d16e0103afd853c6a2a87386874204e5065337ca92812d9f911ae55c64bc4885292850da85912dbb112836a5b955e7b6

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        3KB

                                        MD5

                                        a5d09b5da29066b4b4fad3b32b91f0f7

                                        SHA1

                                        32c5399fdaedaafbdcf75c64c5465319ebafc17a

                                        SHA256

                                        0b828d374865e3183340a2981df6a8521fc73f85c563c70edd56a1ba9020f6ce

                                        SHA512

                                        763e55849086e8a81d241703ce4e65922c1b6cde5e72b58ce3837e0e4b32245079f105efe78d57e95428197a9d36736c42eee46afcb24f7b2e38836fa1c2edc2

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        874B

                                        MD5

                                        36d67de96beae3ffea5c68333e2d6220

                                        SHA1

                                        dd902521a41a41698eaa546d7a3e19234377073e

                                        SHA256

                                        0eee7e884dd58ca187c579592ee241c9169ac3d1a6001b078db735170fca987c

                                        SHA512

                                        c72174ccf76857f90dc0dc1eb178f38e3d0064284f8bd630ae9faa252e8f7d6e7216f9807b5a1ff84cb6b6e51fc96d10e4e0ce6824f1d7d36297a3d24ddac1fd

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        29d22b7d05dff6d94941c74dbf441a19

                                        SHA1

                                        0e9e40dddc5dc5fad120ae85c2c05c4677a16328

                                        SHA256

                                        8c985c1521391b175b1777c496179f2e9933544157ba6558e08e9e41e0b470b9

                                        SHA512

                                        597f9df4984cbe91f1071cfc47ffb2e3fdcc367d37c7ea94fe6cb4b65e7e170f52a86f0269d23cb757e236124ba211ff1ec89478ad792de6ae695c915b8dce05

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        c0dbc2e32c83480cd7614d6f1be0036a

                                        SHA1

                                        d43d51f9867c1a5049b455db43d309d16c2b70fe

                                        SHA256

                                        2e4d3d3d727332a403c874da7ae7f5cdf000c803202db60c7129e837edb03cac

                                        SHA512

                                        3b902cb16938355ec37fb0694ab661430c71d73c5b960dcfc382df04b48264d77be553f95c79ff0159a7efb4e4e66c9d8faeab0f601266e0db363e903fcc5177

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        74f99fd6e84fcb59257720f5ca8d57df

                                        SHA1

                                        eada7c6a2dfac47d5b852debac203dc4cba6c125

                                        SHA256

                                        39681f6e0f5153a4745ced9b96c55d46dd97a4f0c6ad88ae132a8ed7af1ced28

                                        SHA512

                                        df225fffcb25eb84b6f15173531639e1c345e99c7c6b73f6696c3f234bfa10bc30753e341ba17397ea4de2836a018f964c692a57f730e63b44428748a9698cb2

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        4c201e3881f75cf8f79ddd03830d136f

                                        SHA1

                                        0a7e990e7cf6e1cc368189430bc486fa87659eaa

                                        SHA256

                                        4734a73029fd07458ead2baf45f2a370022bb55cc6c2763d7e3556c78c629ca4

                                        SHA512

                                        8daa8507a8a21f5a8670eb3cd5471d9bfef656b9616bdb68f694602f1e01f5c8dca86b111d767444e00099628f5e4b470a1367439f97e6352eaab797b0ac574d

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                        Filesize

                                        113B

                                        MD5

                                        45a218d50f64131b485c4d4da164194a

                                        SHA1

                                        b2a9e3dbae8e1e20f4d2aad0c7e5f887b8c46307

                                        SHA256

                                        78438f47a012960548413a25eb2a3fb195dffdcf681c12ef9acb704eb9bd4758

                                        SHA512

                                        129d608fcc06da73262e63b9e78f081b387876870ca81e12bdfb53e179058e2e1830c8c9f22837d8ce79a6deb7dab49b355462cb2a4f76bf051848e3cfc98bff

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58b503.TMP

                                        Filesize

                                        120B

                                        MD5

                                        984fe0c625eab656e28382656a22d4fa

                                        SHA1

                                        e21a5cbb523e86eb6b5aa226986f556b70bda375

                                        SHA256

                                        ec5d5a4ebc30ce7e41da04ff51842c0fbebe92a0d41ee9f59999b7d2ccb318af

                                        SHA512

                                        6c178e508729765c697123604405cd194c59c29c3667a8278c5ffb2a56ea412ed04022405d2d846879ef9192e5bc2063886214cce7acce3e29b14fec8074b66e

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        87KB

                                        MD5

                                        1a8f248f0ca19af6eaf259f671441261

                                        SHA1

                                        2c4a3223dec16f8f133037ca880c61618502345f

                                        SHA256

                                        8997b7f935097617e5f756736efd80c31719849aa5e2e3dd5cfa8a1ee4d2669c

                                        SHA512

                                        5729a2cfd450e7c7c682368a92a5e8cecf4df739ef40c1bc37f2ba449061c55d59f53bf02f6131b25972d65fb57c743e02e766e09086e45cc7068a7ec32bbc7b

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                        Filesize

                                        107KB

                                        MD5

                                        d133b27e18d119607714c30026f07df3

                                        SHA1

                                        e36a8c1f1d6ba93b9941acaf13d71efc6060e64e

                                        SHA256

                                        6cf44b3334003916adb68b0c5b9819fd46242f258bfef4ef6ff74f8a982ef457

                                        SHA512

                                        2ef89820a04dc4127a92c3a31e150472e65281a492e8163abd4e9fadef84236ea545ed6f33493778a3a37411957903fa2193a8defc7bd90beca3d9d25d79a71d

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe588306.TMP

                                        Filesize

                                        103KB

                                        MD5

                                        9820788607e193a1bcde1a0cb6ac759c

                                        SHA1

                                        18f2b38db18fcd47648b7197c8cc825bb287e1b0

                                        SHA256

                                        ab2e33e4f6a8bc0bc4e4595f66c679f1218288d02bc4ebe94e0be4f9f3442a43

                                        SHA512

                                        8f9edc48706afe74f7730860d2ab184e695f2715d2c3fca99f32d762b54bc94ae3c291d235db60e74c63a16912795aee47ff0394247189c1c0820dea53e8c7cb

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f14c53ff-33d3-4e58-a269-dc0fff580796.tmp

                                        Filesize

                                        87KB

                                        MD5

                                        5bf0944a1b6e361c9e5207c2a4d3b0ae

                                        SHA1

                                        e4e9cd33dda172caeb0d6b2626dda952d7049ea7

                                        SHA256

                                        0891d5c848d246eb4c3f128d3ceefb1da91e93d2365ad43d600f46ccf7065d61

                                        SHA512

                                        308b2e0b170a632b04ecdc9db6a9bc960da03205445f8228e2aa2de2e100f1c944f76bdd1063069d0292c0d343379bb24f035b5bded019f91764206061280200

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                        Filesize

                                        2B

                                        MD5

                                        99914b932bd37a50b983c5e7c90ae93b

                                        SHA1

                                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                        SHA256

                                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                        SHA512

                                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                      • C:\Users\Admin\Downloads\kali-linux-2023.2a-installer-everything-amd64.iso.torrent.crdownload

                                        Filesize

                                        876KB

                                        MD5

                                        64da70c17271a8564f412ab810f53421

                                        SHA1

                                        9e15a7661df3f63c7b332d849343f2e960e5449c

                                        SHA256

                                        4ccb1c71a85cd8a2d6f469fbb981d8be0ae0d0ce47bd4a7dcfe9b9fd45398957

                                        SHA512

                                        dd3fee2bd529840a62cf836752600184cbf2908a53f0a7b319b1cba1560afd1f541d1940a27042c12ce946c62e64f0c625aa4b147f31f653dccfcb0740f1d651