Analysis

  • max time kernel
    600s
  • max time network
    592s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2023, 03:16

General

  • Target

    https://onlinetaxation.pro/au/MyGov/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://onlinetaxation.pro/au/MyGov/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6b899758,0x7ffc6b899768,0x7ffc6b899778
      2⤵
        PID:4876
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:2
        2⤵
          PID:4404
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:8
          2⤵
            PID:4492
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:8
            2⤵
              PID:1124
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:1
              2⤵
                PID:2896
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:1
                2⤵
                  PID:116
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4484 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:1
                  2⤵
                    PID:3480
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5072 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:1
                    2⤵
                      PID:3688
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5136 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:1
                      2⤵
                        PID:4440
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:8
                        2⤵
                          PID:4512
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:8
                          2⤵
                            PID:4040
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5112 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:1
                            2⤵
                              PID:4144
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1868,i,3993027591358576040,10756192017255199014,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4552
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:8

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              144B

                              MD5

                              1654abeda5d8daaab1daf9ae2547042c

                              SHA1

                              53279881e9c27de08f8c6819bf4d4b7bb3ed7103

                              SHA256

                              d36da380cec6f63fdb13b0fd1c2acb32a6e53c3f9a8ba7418e78164d020ec667

                              SHA512

                              fb6b6ee60698dea0f7ad9ed963696456597c37c483047642eab085dc8229b12092da9f3eea684533ad68f071859908802b5c905c7d663f18c5363f4c88752ac4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              3faa3e0c8b4d9fa45685bc838cb53144

                              SHA1

                              bb5427a7e8e5c864f358f14d95841b540fed74ea

                              SHA256

                              4843dabce7236dab03049cb140bba8f08a9c8ba1e450dea221c329b91095ef2b

                              SHA512

                              70bd109ac3e3426edc2cec89cda073af239fede132c17154535c25c88c68e2b7dc0eb5d01771853a0f6fd6015ce581cf2368248a2da3dceba2cdc72397ae687c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              89a70d0e88719801e64e2911c3a4d0ab

                              SHA1

                              9ab904b55faedbe3893bdb15fbfc22b6e43a6bf3

                              SHA256

                              80b1e138da5cf34c4b3e9e986ef6893ab1c427dd8de6262ea132dc113e098c7d

                              SHA512

                              ad982f0d02b072b17aad595131da5cbf259ebb3aa11410ac6b1eafbaab7cf3c870eddd1eb4e32b2ca6f7c01f14f004b067bbec586882dbcdef587de9ef41e6f0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              539B

                              MD5

                              4e01cce7ff2cac0c61fb5622055d5f6a

                              SHA1

                              62a904ffc3b3b69e99ff00bc0505a95167ea6cde

                              SHA256

                              2a77b16812c0fb58aa11ead16860f38135d0f3b0e278f5b074a329165360f969

                              SHA512

                              ea9f3429a70567e055de40e2883d37c4043cb96fafc595e7f7e6e6b2bbff3d10e49f5de49179fc8a29bad364001d4a11f2bd6e9b02a7ad85e29df4a717e49ddd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              71ce79c7c3254b22982928fa89b6694d

                              SHA1

                              ee2f659d471bbd6877f9d897c9b03197f8bd8dad

                              SHA256

                              3b5dc46d9f0ac8cc5685f2ff00ed18cebe6383e55273696de44bfd5044568608

                              SHA512

                              44e661d67e2140d44ca9cf40938537673ed0d496362bda59e8315f06725bda05de0714da96308502bb9d5588e8bed237cbc07bd3354251c73cfc2209e5698d58

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              2caa7fee881f5365aa3fd8a31de455a7

                              SHA1

                              51410efa77c9d296491dbc85f783977d96beb954

                              SHA256

                              23f3a461d60c173c0295b56b4c24a332b8e855fcc01737f5b20f77423522cfc9

                              SHA512

                              3c9bf3cf9a5f45c50dc25c984c2ad020f125eb82691cacf78a815f49c67f44df318e85a89d670965f7cbdf27e801c7586ce4c1a1e4b5036c3775f4dd1267a23f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              109KB

                              MD5

                              863e10fdca09ca0e5fc6366832350f1e

                              SHA1

                              06ae940f4a07085ba7cfec453c952b01f594091f

                              SHA256

                              11e5a0efd3a195a91b3bdf0441c7e2783e8062d163c3e67bf71cd95a5721a227

                              SHA512

                              bb8a5e7c0b8fef7223f8a1bf42c489ac4942a716fa573f9296631a83c73c975578df5817cb8b027ad5ccd4aebe10fc3f88d58d74bdbc36da3a7351486d9f57c1

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd