Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2023 14:14

General

  • Target

    https://www.commonsense.events/events/nl23-akamai-security-and-trust-2/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.commonsense.events/events/nl23-akamai-security-and-trust-2/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a9d29758,0x7ff9a9d29768,0x7ff9a9d29778
      2⤵
        PID:448
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:2
        2⤵
          PID:3932
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:8
          2⤵
            PID:312
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:8
            2⤵
              PID:3240
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:1
              2⤵
                PID:4600
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:1
                2⤵
                  PID:1488
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5036 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:1
                  2⤵
                    PID:2904
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:8
                    2⤵
                      PID:1460
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:8
                      2⤵
                        PID:5180
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 --field-trial-handle=1872,i,960016078935637299,16373637388783141855,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5500
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:1900

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1569cb3a-4c4a-4942-8950-f6e69a4b7ad6.tmp

                        Filesize

                        6KB

                        MD5

                        99d8537078c0191f37dc20b8bebefe98

                        SHA1

                        9bc94ea2058f4bd0a79c3037404476663fa06a6e

                        SHA256

                        38d193dd85d423d328812aec2ebce7b8f6f9c1b2c69f5fe18b180ccca08c5745

                        SHA512

                        1b2cc92b70a347d5eafdb0a1a79529ec252a481995cdfe96fe1bf6bd38b1e9547edf16c520e7470b4c3b47c325b3063fc5ea09b092577937e34444a7bb44d12e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

                        Filesize

                        186KB

                        MD5

                        740a924b01c31c08ad37fe04d22af7c5

                        SHA1

                        34feb0face110afc3a7673e36d27eee2d4edbbff

                        SHA256

                        f0e1953b71cc4abbffdd5096d99dfb274688e517c381b15c3446c28a4ac416e0

                        SHA512

                        da7061f944c69245c2f66b0e6a8b5a9bca91bda8a73f99734dcb23db56c5047de796fa7e348ff8840d9ac123436e38a4206408573215b7e5e98942ea6d66bb7c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        888B

                        MD5

                        2c7e4db3eacfa8a4eed92cc7d4ca5e0a

                        SHA1

                        03c222ae33026c25a8cca9720bfda5f31ac59da5

                        SHA256

                        ef272b10ab024bfd675002d797992f01c8bcec6adc49fe905cfa51a63efd9730

                        SHA512

                        f1da737d0888fd63bad5ab1c3c91e4247279258c825cb4baf0528c37b46f6aa94bb96df5fec54697258b9bb3cbaf464e2d5ef232901413fe26a0ac0e5bf6969d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        3a0c9e51cac9166682a8f1905bc6dd9d

                        SHA1

                        7027c6320405999a5bfc20899530fe68246fead8

                        SHA256

                        bdc6cec7eda22e64d291ef06c7a92235c7e9ce90e2a3ac63e83e1d7b7b117e86

                        SHA512

                        33d428d129615d672cd7f2ff1aecc1bd7d7dd87042484e5d874c1d6e13207c0a86d977e993533f42eaeda09b32d5a2c6658aeaf112359599ae8d0f4a87ce0852

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        5KB

                        MD5

                        2f6ea13cf9ea201cd4883708005c5359

                        SHA1

                        eb9525a35ea47cb65a9e80e9bfe677b4c68ccc51

                        SHA256

                        e9b5500846d9c4ca346951b83ebd19b15169937e8c94f6ffb98c9971bf622711

                        SHA512

                        41897ff9bbfb23426c58647daf204ef2025370ddbdba31fb8c3c07d1862da95edd49483b0213e0c24487fba5ca2d3e52c704217f37e28b93b5b526446b2c8e9e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        2KB

                        MD5

                        cf068f916cfc68184def9960cca79034

                        SHA1

                        1c295238650fb48eefcfa226c80fa1da566dd51a

                        SHA256

                        c70c94b1d6e9594b84aec9c9d34c26b2cadb5b66f0b20cd53ca6a15c2c7da161

                        SHA512

                        6250adad03ab073e0a84d5cc212405e4bc7f3a9422a84d62564a0698d80a80cdfd5e6acc3ce11df042659c0178ff1c0c051039b6f15ef0f4652eea823ff46a87

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        2KB

                        MD5

                        447016687d0cde154980fadd48dac450

                        SHA1

                        22450c49385a3b885af7114e19e445bc84638889

                        SHA256

                        8e873e9dce3ffe7251cfa007b7b8d3bac5f8d6d3ba754a4b4275c1e9a7eb1625

                        SHA512

                        4fff26855692870d463f352f6a7f521a10a893833267899c161baacb458c325241bfbe17db9d60dd26e1f0e77ef09d5d5c8c4d59846ee84a60f6f5b0e885eadb

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        2KB

                        MD5

                        ce992054893cf023027677e3a4d82ca9

                        SHA1

                        4f84eea88885a59aecc03e6195f0b91d812ab07f

                        SHA256

                        d1fb678afd280afb0873715a6e5c5ccc095799925d60064dfa3b2ff7f89f7fce

                        SHA512

                        7d3d7444f65d876d0ddc70ba03f427acdde9fc53b6bc7946e37a03b8d0289d2929f6c17256b6d8e1578c87f18f6015819b506148f3f5bd16d9e1e7bab85901b7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        109KB

                        MD5

                        e4fcd2c9b80e19779323f2cbe6c4ce5a

                        SHA1

                        ceccfb663a6e20ac2d1b3245a46fb93ee2db0f0e

                        SHA256

                        71cc64e373cec9db8ea1874425f7cfbffe40b8a0db56a6defd18a3d9b087767d

                        SHA512

                        436ba99900d97f3308b260927d4e4ff66f2d44dcf1ea8feb41a29bbf3766a24f4ae182e3db8343979cca01941c9ea5bdacad8e9b194626aa3734764d6efe77f5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd