Analysis

  • max time kernel
    617s
  • max time network
    606s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2023 20:21

General

  • Target

    http://www.champlaintechnology.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.champlaintechnology.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3244
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3a1c9758,0x7ffe3a1c9768,0x7ffe3a1c9778
      2⤵
        PID:1348
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:2
        2⤵
          PID:1720
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:8
          2⤵
            PID:4140
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:8
            2⤵
              PID:2832
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:1
              2⤵
                PID:4652
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:1
                2⤵
                  PID:4128
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4696 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:1
                  2⤵
                    PID:3672
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:8
                    2⤵
                      PID:392
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:8
                      2⤵
                        PID:5000
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 --field-trial-handle=1892,i,8266077536393279629,13187869746413853508,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4092
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:2236

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        216B

                        MD5

                        08cbc7aea3933dd8ba15ec26762502d0

                        SHA1

                        898b290c159e21936d4c69aaca9365047a5e80ad

                        SHA256

                        00a3ed4c6d15889ad8fb9ac17d5358a446eacb017fee252ef914954fb0df34bc

                        SHA512

                        89367e8e628e359184ca6f29ceafe1bed39384aacacaa84727992ba1bf0b163cb622c08257b67baf3cb5b27064c4313ecb4d4df739c71739dc7c46a79468bbfc

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        8dc24724fbe54038b6078606a5a46f98

                        SHA1

                        8b64a0bc3aaac668051c4f61dfd0aea4513cb27d

                        SHA256

                        0a56771621003c051e90d1386343690119169589c7c6be65e70327b86be1d00b

                        SHA512

                        35486836cc038d6ee19124cab0a37eb5d9414e9ffb11458abee835fc55783314c82e972fef3ebc381d5cdc0c0c69d928878f41acdce207d8b5194dc9e0f85272

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        01b3bad760d2c59feab8afd8dfdf121b

                        SHA1

                        cb0c4b7c83716e471d1e2ce9233105d6977c1cc4

                        SHA256

                        5aad89982171844533ce895d9115e34e87a1e35bc9da4bc802b0447f41bd3f2e

                        SHA512

                        86e8c8111ff4dfa32ce75707355f05d943d2f10a5bc5f36fd2ea75f383e3742019245296b4281b55373d2226328b4440e18405e5f876853dca3f3e32538d3a3d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        1884647d8f99591071b788b00defb078

                        SHA1

                        23c703170996f9f49dd8fbc5cf8cd696e197f3d0

                        SHA256

                        94b0815aba05c7f39b0bb31c377e1f864075d77be78d8e6b881e91647e59a1b3

                        SHA512

                        11f7d7f462a1b51298a169b8277f6ebd3dcc82350fbe6322b7f13dd1ba5270e068fbffa68c6939ddaacb743285b927d1ebf2f48c0885277d27d783b106555788

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        615d24d10c7cdf98092139471f59d976

                        SHA1

                        3144399ca486af48e7000dba74211b3dd43e6827

                        SHA256

                        8caf8add45e76ef20a4c82efe40078c200e779c4c88ad6efc7f3386e2570fda9

                        SHA512

                        11ff3135b0ea63dbfa3c6080c654a41646a0a53e65d79727da6f37150354a0093c77900109546e2b3328f2d0bd2d9308c380267a653be9dfce77527f1a4abd58

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        21f4575e245626f93208657c2c742745

                        SHA1

                        6fd71c5be1d48f0a1bfa7a55282de34c3c88b1fa

                        SHA256

                        b22551eb2897af1698619ca3b1ee5e2fe6d5fc75247a2af560cb9ff975780bc1

                        SHA512

                        f6103dd874187fe487d6a12445a45770f368c0b0dbfe1f446d98d2a9418a1b0ec13ac168830e33b70dd93202e955fc1b3d15717d558ef279053ff71af86df41e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        872B

                        MD5

                        04505771f9537dc77080966f339c59b6

                        SHA1

                        96de147d21c691dc98085e6d925a7364722e3ef8

                        SHA256

                        3c6de0010725638225ba33d37054c9bd83db765e3d6bb4eee3622b233bedff4c

                        SHA512

                        eba54d80d6310a6ba5dba92f0837431ab1d8a7868561af26ba79e678b297da3a6371e6539399217f66806521a9251e059170968d34c8dab30046eb999674d398

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        538B

                        MD5

                        1b27263ef6ca4f2f4c6ee5d169f6aa0c

                        SHA1

                        35a43db658594b2fa8b7c2696440deb48b443a5f

                        SHA256

                        fde24cafac72d49c40ffe60e21ba476c800a0fdf9eb858c398056890329a458d

                        SHA512

                        c264be87d8a5112ff129f9c5a7a38c63325e559209fc9d31bf6269a6a6cc6c280d282ff79a9e394202ba33ef9f0ccf49ba3f804f40e484ec052521df4f5832fb

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        3e790349dfb327a5de32b8bcba3da16d

                        SHA1

                        fb3ebe5de52772bdbb9408e7d08432f6c842b70a

                        SHA256

                        e99bd308c1173d5bfca0faf979cdd8d3204c4b7bfc7a927543327bf456f4e9ce

                        SHA512

                        323a688cd42db5f02ea2fbcf7af4b92e38588cb0c747b2701a8b5170d4fd881d1f3cba28845dedce0a277e5055881e2dd2bacc878b5718c515369368fc05bdd2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        101KB

                        MD5

                        352a2bae0a42a0eb5b2b0e2fa4fe4459

                        SHA1

                        02ef8cfdde74008988018825d62acaf6547706bf

                        SHA256

                        227d79c32725d9316533494aff0f70f24cc7a5f53665384b09fcc206b63b4226

                        SHA512

                        4edddebff6895d9b8d5773ab5663494a2550b5cf87b79158621ea980808700c4a3369f93cc5971e1af6af89b6e5cdddd08facd2b767d239ad5c65a3ab69537d0

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd