Resubmissions

25-09-2023 22:51

230925-2ssm5adg99 10

25-09-2023 22:50

230925-2skyaacf3s 7

25-09-2023 22:49

230925-2rsxhacf2v 7

25-09-2023 19:47

230925-yhh46ace26 10

Analysis

  • max time kernel
    600s
  • max time network
    594s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    25-09-2023 22:49

General

  • Target

    fyb_static_endcard_tmpl.html

  • Size

    3KB

  • MD5

    d18fb1787ce0e84567496b8564e452aa

  • SHA1

    007033d0824685600611af6992060577e127dd23

  • SHA256

    2ae5e0576febb1a1cd63b10bf71644f99fcfd0fe7fb1f2d19525594165294e51

  • SHA512

    ba5225a80941e3ee4ff18401b910968a6cab47634914ecb68213599b96fd4b39c8722e82bf2883faf355d9416a6f2acaa36151a5d8969079cfcd4c6795f6003b

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fyb_static_endcard_tmpl.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89b0f9758,0x7ff89b0f9768,0x7ff89b0f9778
      2⤵
        PID:3948
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1836,i,6540174748896902387,15507200121365196866,131072 /prefetch:2
        2⤵
          PID:944
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1836,i,6540174748896902387,15507200121365196866,131072 /prefetch:8
          2⤵
            PID:4232
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1836,i,6540174748896902387,15507200121365196866,131072 /prefetch:8
            2⤵
              PID:4080
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2864 --field-trial-handle=1836,i,6540174748896902387,15507200121365196866,131072 /prefetch:1
              2⤵
                PID:4928
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1836,i,6540174748896902387,15507200121365196866,131072 /prefetch:1
                2⤵
                  PID:4104
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4060 --field-trial-handle=1836,i,6540174748896902387,15507200121365196866,131072 /prefetch:1
                  2⤵
                    PID:3680
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1836,i,6540174748896902387,15507200121365196866,131072 /prefetch:8
                    2⤵
                      PID:1876
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1836,i,6540174748896902387,15507200121365196866,131072 /prefetch:8
                      2⤵
                        PID:3812
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2872 --field-trial-handle=1836,i,6540174748896902387,15507200121365196866,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:240
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:1508

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        93a740c894c766a9e7fc4891aabd1276

                        SHA1

                        0c4a5c2c3d065948ba8f2268eb36fd5ad8dd1370

                        SHA256

                        f7fea1ffd9f31231dabeaee83287c5b37ba4aff2571eeae8741c3fb9734fa97f

                        SHA512

                        b8c8467a999aa993e66cef6765553dceb4c8ae38b2faca2eebbb799e7fcffa5dc3f65967a2abe58ac445db11cdba3f94ef01e11520901304400f207aba99ea43

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        a713a4ee9b6021fdb516dbad06e835a1

                        SHA1

                        2952d5e0f483d9cfb0a004847a0d377ed8de3bd5

                        SHA256

                        d92e47fc920fdc10b65dc56bcdeb3d55d91a59bc2570dde6394a4caa5a48f7a0

                        SHA512

                        26205993d92b3ee3d24abc74a221cd64c7a1282e033374bc1ce9804ff4c4171f8d205f8a028efc441f9a3dfa1eed6ed3db6bdaaf0e43392db5883fb238fc4a29

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        8cdc935905b3f02b9c77502bfaa8ea24

                        SHA1

                        f4e9c78d44453d0a22c1fe0d5d29391d1a01e77f

                        SHA256

                        1b25a439956e13dae8e8bdced7de4f3d81d94d789e7c3cdc2c0cc2e51dbe40ec

                        SHA512

                        dfaa7879cec2233c67d6bb9e5325267eefe1ec8213a65ac7a29d6035ecab9467a910a66791f7400cb2ee261a8ba9643b2ec74e0696bdf6b7cb2837afca3d3319

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        b4cf21230c289ee2ec6d4c96933847fb

                        SHA1

                        d79405189d0c458a520c12dd5f1c15d9c87e5ad4

                        SHA256

                        22ba6fe4a3cd5cdd8e84ad0b008ce5b028006d26ca66df6504e000a174208e3a

                        SHA512

                        18b1f588c78e8266797a757bdab2d58fcabd83cf3016e92a387556978480c4ed4150cd64ea5c96bc37a52a27c09c7e1a9a709a0d13d172a4bd01b46a5a220175

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        101KB

                        MD5

                        a196ee2fa8844159cbcd8370bbb81bcb

                        SHA1

                        94361982e01c681b3cc793b7527781658491917a

                        SHA256

                        103033875e9925bc228b62e819d7f021dd3077bb4e969493a171434e3bb7800c

                        SHA512

                        65e17790a0ac933fb3353d8b4cba6ab2ae1d1655511ac929462f3cb5ca666c2dce64e8f1c4d64daa5f99d0c3a661444fc49829bf2742be3df1d78c39b97670e9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd