Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2023, 21:22

General

  • Target

    hpinc.com_.html

  • Size

    273B

  • MD5

    1dcb8cb82db8422f541c6fd4d702abab

  • SHA1

    7a52ba7d82d266827a2fe902022c6ce11b7521a4

  • SHA256

    c136130248559e8d39cc067a53fc9f95c80510a4d934dd177a3ceb0676035d09

  • SHA512

    689bf37a72b700007c1b55dfb3886a1d5cdb9a1e4ab91afbad7509827d92703bf20d71e0aa842f8ba27515501ef169417063fa9944a98a8777f9dd9578a2007f

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\hpinc.com_.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99e589758,0x7ff99e589768,0x7ff99e589778
      2⤵
        PID:4540
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:2
        2⤵
          PID:2816
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:8
          2⤵
            PID:3532
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:8
            2⤵
              PID:4012
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:1
              2⤵
                PID:4024
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:1
                2⤵
                  PID:1760
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4500 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:1
                  2⤵
                    PID:2480
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4744 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:1
                    2⤵
                      PID:1048
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3020 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:1
                      2⤵
                        PID:4492
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:8
                        2⤵
                          PID:4968
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:8
                          2⤵
                            PID:4808
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=820 --field-trial-handle=1888,i,18010670309746555331,4125323257011640162,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4400
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:3540

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  96B

                                  MD5

                                  96057434b0cb713e41a2268d40e7a930

                                  SHA1

                                  68a7d393befe37dbe3017653dbe02e25f749b5de

                                  SHA256

                                  99fc9228a93ea980e2203910225d340d892773334fdae3f6e7e6e99d3511abe7

                                  SHA512

                                  a34cc24a10f9c44e754ad1b59956039a8cecc3634df941c0c1cae9aa8dd210e3b44ce8ff1e56626a6ff6c3ba2efa6cc732883f414a45f187ed2a6b024804bb5a

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  2KB

                                  MD5

                                  b19d6461349db1bdb20ea8d6586b1ad7

                                  SHA1

                                  5ae6443d02c95db926f53d552417976a3a2c3b30

                                  SHA256

                                  9fe9be54d54338857e054b7e84a501302e499bc6cc2ee35b5fb8ccb7008396af

                                  SHA512

                                  b1f9b647b37d53b872fc60113f33c203bff9aa37df6bd2387377f1ab2aea8715e53875ee301ebafaca837b21b5e400ea2fa8281d0611355ccbe9a1e687d0473b

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  538B

                                  MD5

                                  761326fde25a9151ea994dac55952f02

                                  SHA1

                                  be11399ceb73cd6754586d565e12f50021a2b10f

                                  SHA256

                                  ef2d6eda898def9f082464115d4809b3464bc9c913463e64fb059bf4a89947c2

                                  SHA512

                                  3879cad1d77e376a69ab78b60e268e2a72c11aa3a551b8cbaa4fd7a0d1e3366aae9a48d36e2a88f7b4bcf38304c27b34020633fbc21bf157abbfa2c6e10fd330

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  f59c388a997e96bf42e9aef624c81816

                                  SHA1

                                  cb47afb0f3d7bf993c4bc8e73ec627cd6f5b5030

                                  SHA256

                                  96cc86254282a2310fb3e1e013a74295f1cb73e9c44843b3f6dbbaaa9eee6c2a

                                  SHA512

                                  a96dbcb526149f25c71fdba5c65b4c90596b09fafb1e203208beef8fd68a629ab42c92da3a1cccfa6692c190a2bf61be8ace7ee8d6e5c87ca0a8b6c711117208

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  dc9ccfee01683343a9a1a09a8be08450

                                  SHA1

                                  b329616f8ddbac8e326b9daf24a263b55863e57e

                                  SHA256

                                  ea5336cfbc0e7649174eb3c30c1d4323f1483cd8023070082c25679d7db43810

                                  SHA512

                                  850f88d15d42afe16c8cd7268504aa9889de29fba902a19b7f2d62b777cd6d82aa2d1cdadbcfdd27fe1ebd468d7389845d14e779b0623a5c4baf23d8ff4a79e0

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  109KB

                                  MD5

                                  3271ccb539f36d0d9f43ecb7c396e300

                                  SHA1

                                  4d593b6c131cb645c394a768d3fe0b62a2ef1afd

                                  SHA256

                                  622cc4b329fe07dad3903c828534a2b7508c0ffe2817d808d2d8576f13a41fbe

                                  SHA512

                                  b5ed14ef7d51b0dbfc0d3a2ceb199b0df78acf3d0a3cc494f32a4bd56b32c4486ca62578f60b6927ddb46cef19cf5eb92504a2b287aa2d8729b1893204b6071e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd