Analysis

  • max time kernel
    300s
  • max time network
    293s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/09/2023, 13:30

General

  • Target

    http://www.truyen-online.wap.sh/ds/4-loan-luan.html

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.truyen-online.wap.sh/ds/4-loan-luan.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2436
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa35799758,0x7ffa35799768,0x7ffa35799778
      2⤵
        PID:2760
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:2
        2⤵
          PID:1652
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:8
          2⤵
            PID:4128
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:8
            2⤵
              PID:2648
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:1
              2⤵
                PID:4820
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:1
                2⤵
                  PID:1008
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4572 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:1
                  2⤵
                    PID:4520
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5000 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:1
                    2⤵
                      PID:5048
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:8
                      2⤵
                        PID:2832
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:8
                        2⤵
                          PID:3568
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 --field-trial-handle=1900,i,330637006795439148,6922356032397697231,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1424
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4300

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                96B

                                MD5

                                35cd1b73ad0fc9affaee87aadb1823c3

                                SHA1

                                5f125526c3ed650396f34e499a2d9c63013a8f8a

                                SHA256

                                f8ae5bdba8dd0e5798140ab3b71c3a0d2f9954c2cd629378b1bab45debb13261

                                SHA512

                                314d7d345e2dc2a95b90a944c5c75a7be1b773534f99741520a9a05973b9e2c6d45689679e72eb168d4a01a502cb7ed9475f870b468de5931d5f468c5f5a5020

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                2KB

                                MD5

                                ef6c59503f3b44f707ef14fef682e4c1

                                SHA1

                                bb87499bc809cd33267ace8eb97faa9dee5eb2cb

                                SHA256

                                0f7cf30aab8ed81e67aee72cc180b2d18f4f390618aa796274d042dd14203f91

                                SHA512

                                759d36f82036e50ca9d3796d585b8d9f58516c6a33e4f0f4d5223491fe7fca4f780371f342148ef4cd9fad07b2ef1db1fa5cea8231a8cff64dee72e7cdb58fd7

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                e5ee5ab89114715e1cb56ce3ea88099f

                                SHA1

                                c1c05755e6c2a3eda768a79390797d4ace095d4a

                                SHA256

                                6346340b512fe74ef91cd4a5fdf141cda32b743a04e1e9891278b58a291f172e

                                SHA512

                                8d78456b156c434ea82affbedf531610bb936e403bea6570a98a9be1ca86bf7a41dff2ae2a1091abefd32c6634ad0dc43540339f61e67bcf20310e588ac3c019

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                704B

                                MD5

                                171147b6b2f2d24da2b77d2e9095658a

                                SHA1

                                262ad479d9023a0526b0c4813d82ebaa42ba7643

                                SHA256

                                47ca7e5d65b8c56ca99298e3b2d7e37acd291c7ffc80b66ea47ea5f4fb6fcd7a

                                SHA512

                                a402a86ea6439b04a056f6e826a5024a21f35c575296e29b1ab7b29054a30b9ec3bbe5cfd69665f55ec525f17977f590dea1986dfaa35a5283da9c6b2ae2c84b

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                a6ced242aeb4f8211afae89f2966f8f9

                                SHA1

                                778c1d4cd02c75957b3f2368900ed08bf5695623

                                SHA256

                                2794114c05ae692dfbb0e0a9f950cb616cb4fba01683dc7c43521e1fa4a9dd96

                                SHA512

                                e614368fda4bf7ee3494367aea9e9e4fc97d0c16e1a95baa74ad5c742e094e26f090588d09dcd9a358bd88ac959d766d61520a8e42ef7d9de0de98d7b22e407f

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                80aa7ee6e418a4a930ea863265cfd799

                                SHA1

                                77b763eab4bac4f8bbddd5b13b7d9717b326ab9f

                                SHA256

                                0094ad778a8956fce8ff8aa611a2159c6818201e8ba28d13bb5b438f342c59b5

                                SHA512

                                a3316491d54f38f0c96513a575dd70381385021cb1fb91e72766b1728d9c16a4f6e491faf040928f2cb9bf02e7d80bb1fb6e05cb5cad4609cffac324e376bfc8

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                9384e1eee452db6c6ab1f5d6de7ab208

                                SHA1

                                4b88547f56b8a397c5e2c1443f56211a66793e7b

                                SHA256

                                603418e932e6a82950559427b91d2ec285a4ae867dd66ecbe7c318af71502f76

                                SHA512

                                b2ccb39ee8883312970f3aab3455ee0bf7b09c34e40c6571b4bc3c09f0ab363d74d4871954190f2aa78fb2f0e504c6b987b20419843e6885873fa7048a7deca9

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                97KB

                                MD5

                                339a8acb59aac058d634243acabe762b

                                SHA1

                                8a5d657e6bde6a4ae669e3b4235b1f46a89f4029

                                SHA256

                                65517ddf62a3ccf506fcbd2c581d89627c2217737e1fc1798ea3bf88807bb3e9

                                SHA512

                                5d1890a9057d14b9751d7b5004377555573c0a8388c12f304c6d90c4885a2dc5d78119648e9e755771448d15b69227e37ec040f142a2d3edb237cc7ccc582d9a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd