Resubmissions

07/10/2023, 07:19

231007-h5wqrsca56 10

06/10/2023, 17:57

231006-wj28bagh68 1

05/10/2023, 13:51

231005-q5yt5adc98 10

04/10/2023, 11:32

231004-nnn79abc3y 6

04/10/2023, 11:01

231004-m4spyada28 10

04/10/2023, 10:53

231004-mzfjtaba4y 8

Analysis

  • max time kernel
    1859s
  • max time network
    1820s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06/10/2023, 17:57

General

  • Target

    https://github.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffbe0639758,0x7ffbe0639768,0x7ffbe0639778
      2⤵
        PID:1528
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:8
        2⤵
          PID:236
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:2
          2⤵
            PID:3968
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:8
            2⤵
              PID:4172
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:1
              2⤵
                PID:4180
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2856 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:1
                2⤵
                  PID:4276
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:8
                  2⤵
                    PID:1192
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:8
                    2⤵
                      PID:1240
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:8
                      2⤵
                        PID:836
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1844,i,10925300119211814887,13455962569617184151,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3088
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:5016

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

                        Filesize

                        1KB

                        MD5

                        d56705afdfa2b9d727ad5499b5358fe1

                        SHA1

                        c883f9eee0e6d9d1207dbb14e45ebe3cb05b8213

                        SHA256

                        01edbdfe9eac8506c67e9ae189833159e38ab45c10b93ec2147c651236721c2f

                        SHA512

                        68af082a14914c823749d8082dcf716e383889b5bbae14042d186c984b80ba329af986f902cc8d82fa94e01d405dc76375252bc19115e88a6a563ffc5988e71f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        2547ea5ce7964ec8f6d4dbc8e6368bbd

                        SHA1

                        4df7b39ad6c020be7abf33e4861e4c192bbc8b6a

                        SHA256

                        9a819e6df8c5cbe2d290506d31fe396c0174837147588de90c17e3e1f4f9d165

                        SHA512

                        baf006e0cd905587ac07614d5ab622966c663cd9c4217d0e7a277dc4c32c6c0fb5a9710702b30f8f41f30c9ce8c19a53b7e26291485d32c7b3ad59ec519ced1e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        0354b2d80e94c2c1e96792526b6ad701

                        SHA1

                        fdee043fa4a86557f034f7ec643bdc59f5ecac45

                        SHA256

                        b4881f58eeb8b86a64262f690132e84088e6b6dc461917ac87d5310f0c77f3d5

                        SHA512

                        c5f6dbabda4875467e927184f4ab14850f3d9371d99ebb8227659bdca99479f209275b037cae013cb1c4b77de76b31f33c27e01503c838d8962bd64798550ae7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        e7c132b50901a371cadaea55da8ffb7f

                        SHA1

                        d2944f05579f93beb288759d3b59d3c29ef0bac5

                        SHA256

                        5de9dd849cbb426f086e01de92d5b730c34b6921dcddf45804a9bac47c36099b

                        SHA512

                        f69ef630fbf5c67f14467f588616e1bcca6df4e1065ec52e25581027a58cc1ed22efb6667965d499875064966f38c6bfe8147d4992ec1b215df9c288f81f992e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a004b22c-c32b-4729-aed5-93fce5c26160.tmp

                        Filesize

                        1KB

                        MD5

                        a34a379655f915983ae85ac3264636c9

                        SHA1

                        7b6d092ab4dc1cf83c70fa3d48e9c175b5563e76

                        SHA256

                        c7b126954d57040c8c4b951becdf982836246c1e598bcc49ea9f3a4336e0ed57

                        SHA512

                        2f69741f45e5e9e1f012ec262eeb95b38d1a39ab4f178c36a721723b6d525c4fd0147b7c8cfd2a50834471d769dd7479deafcd126e58f55578505842c9e6a70d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        e981e3b0622c7d0058b88f1636a34140

                        SHA1

                        740318368be954198b3df9ab7b6b0d5eca71ab33

                        SHA256

                        0d51c1e4f7ca08e99d486b5e836bb4ab55264e6638955650867fff09c1076342

                        SHA512

                        4f7152671cd56372f58f9a3ef4dc9d64f8df0bff655eb308842480689ea504ac52bca5b32ff2e3ea1036b946c85ec3bcd0fd6cc812917a1d28a8162af37de28f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        566fe2d4fca644d081cd9feca41c45fd

                        SHA1

                        101c14ac484d85dcaa841c453713ce962c5bea75

                        SHA256

                        b247955aa14b3edd4ef4a1a95a5bce4a69cf8b868153bd45dc84f4f04b0b94ca

                        SHA512

                        6041695ef3901880374bbd50979c353dba69adce94bcc393a0da99360dc9ffffc9a59e2bb7ae8276468598b57aae7ced1fe06f414230126fa6273dab8c6cbd91

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        28a0a9f28feeafa273fc8654130aaf7f

                        SHA1

                        5d436bbc5e0208504597ac5aa91e59a1a22bd1d5

                        SHA256

                        69a9136e62659cd00c54a88ef31444393306f9ed3e82e460a7d685b7be41313b

                        SHA512

                        d81cf95fe2cd64563c43ec117daabeeba88d5955ac02f665285f9478d006b3edead36db427cfbdfd13ad5d14fbbde8b530b39d21fdff833b29c8dbdf1c449484

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        101KB

                        MD5

                        6a0091353cef8d8bdd61be38e737c3b2

                        SHA1

                        8a0eaa3d7abf7863b911124fadb39d362090ceb5

                        SHA256

                        0df7d35f7883b54670b7f4c75f1d5cf89ae58e01c0f9e4ca175fd3aa536ef340

                        SHA512

                        34c8f060a03ebddacd12e5c7ec927f40bf9cb294ecd739f9cfc4002a6f1db8476ea17390679575fdc0c6cf69117365a6a18bbe01f1d759533ecdd8f83c69bd33

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd