Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 09:46

General

  • Target

    Google Chrome.lnk

  • Size

    2KB

  • MD5

    bf01d93113778bda94e738ba93c56bd8

  • SHA1

    396cca8c1b3c06aa0d6c797305333c5a959362d9

  • SHA256

    c0e23f3050d2d177ee12205d6be8e87db9c5d9e8aa2919e01b4e6503d8e7ed14

  • SHA512

    6b05dec21e89bd544931d2284a302b9f2ff8ce7d1e62b0af46a66bd78f1b752d2296530f5ce01457cad3640a88229cb1ae0904c924fa5f56ba02ccb4830183ea

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Google Chrome.lnk"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc215c9758,0x7ffc215c9768,0x7ffc215c9778
        3⤵
          PID:1028
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:2
          3⤵
            PID:1564
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:8
            3⤵
              PID:1996
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:8
              3⤵
                PID:4996
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3220 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:1
                3⤵
                  PID:496
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3204 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:1
                  3⤵
                    PID:4564
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4708 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:1
                    3⤵
                      PID:2436
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4800 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:8
                      3⤵
                        PID:2736
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:8
                        3⤵
                          PID:744
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5232 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:8
                          3⤵
                            PID:4308
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:8
                            3⤵
                              PID:2180
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:8
                              3⤵
                                PID:2168
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2936 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4768
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:896

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              dc815fd47d9437c5455d57c768649c54

                              SHA1

                              30585ca0e45ac2597b89c8df3f4544abffb492e8

                              SHA256

                              9a6dc7ae0d95813fa83d419b54f296c4195c59b9ad8cc41c5605b5202588e952

                              SHA512

                              daa72bf91f1fdbfeaa5ae78e03a4442645c91afccb7626e9e455aaf3606e47578d9e8342626a018adfdf032092be56cc7bc9f267c72606f1c9cce4eb074babcf

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              371B

                              MD5

                              a981a3d2fb55d65a18230200104a860c

                              SHA1

                              7a193939f347dba2d6402dbc3ec5f18bdbf65dbd

                              SHA256

                              9ee7753d6dd3df37202371f3ba4bc9ff5b84833db11db254e21ec1b1dad725c5

                              SHA512

                              f12bb077d54dbfb6e38a3edda56e7f6148a36978b9c5736a3258f8b4de01cd5c2f19da54d82e7aaca01c55e256722126ff1a59743db7a4cd1f691cf200fa43ae

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              07b965226864a59225521475cdaf645b

                              SHA1

                              c2f06d825825ad3acbf0881c995b86a1d28ac2b7

                              SHA256

                              54d0964a95d9fd2b9ad1d536854ba9d9532c5a9a611cab31e5062fb771dba449

                              SHA512

                              c504c684a1a1482e54f232a9d7bdb5fe4ce10055ed2c50009344a9e8016605aa122383f5a2e707f29b67da4445062bb9cbeac56fe5586cc13c01f3fbf8e9d062

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              48cb1e2180a23c199e7cccc9c465dacb

                              SHA1

                              b34c79d31cfd97925e6b24d42aae17d0d7a86c55

                              SHA256

                              70bb88caa4465676665bef5912ee4504cd34f5b44bb5bf254218c319732bab4b

                              SHA512

                              e65e3881ae80fd38b76f68f52326e08c3ae68842a89eff5c10e100d82fe5911129491267a904fb56342d30cccfa3f96543814b115703ebcb26254c21ca1fe864

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              15KB

                              MD5

                              eaca9ed27cdb0f9610eeb40b6f863743

                              SHA1

                              29b799a58fba1163f75b1c5fc8a2caffe7da3fca

                              SHA256

                              1287a6dbb28d917d09edf073ab38b122210caaa45e5cc2c6273863f4dc54ce36

                              SHA512

                              497344b42712a211ebf15c529dbae08e259af79cf8c77f9cb069a429e4303b096bb9722f0df8336fad45f186b4f1eef16cd540776a86ef340bbf62670b62863e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              203KB

                              MD5

                              223f01a70585efb5522a3bc258ccd09a

                              SHA1

                              ef3dca2b9e5201072bf554beea24335bd09afa28

                              SHA256

                              f8c46bee2cba5b37c8d9f2612975bd8f4a4da7f91cec1a1702d616a62eadf8ff

                              SHA512

                              c7db8057061da8a5a76ffa464872952fee0c82741e9fc03e12d25e917270d94db798f4e5e9f4db9002af1f1db2b63b140e20abcf7e7683a2b082ba71324cefbd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd