Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    14/11/2023, 13:14

General

  • Target

    https://adobeacrobat.app.link/EUy9rO19eEb

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://adobeacrobat.app.link/EUy9rO19eEb
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf4a29758,0x7ffdf4a29768,0x7ffdf4a29778
      2⤵
        PID:4056
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:2
        2⤵
          PID:1104
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:8
          2⤵
            PID:2304
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:8
            2⤵
              PID:1296
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:1
              2⤵
                PID:4668
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:1
                2⤵
                  PID:1464
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:8
                  2⤵
                    PID:1248
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:8
                    2⤵
                      PID:3780
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=6100 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:1
                      2⤵
                        PID:4088
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3348 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:1
                        2⤵
                          PID:3876
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:8
                          2⤵
                          • Modifies registry class
                          PID:3480
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5584 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:8
                          2⤵
                            PID:640
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:8
                            2⤵
                              PID:3744
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5484 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:1
                              2⤵
                                PID:1532
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5956 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:1
                                2⤵
                                  PID:3648
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5412 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:1
                                  2⤵
                                    PID:1256
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6428 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:1
                                    2⤵
                                      PID:5252
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5408 --field-trial-handle=1848,i,13830296786251885328,13939632959715024369,131072 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1912
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:380

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            3KB

                                            MD5

                                            7ac59b93b8ca4e5e3843019c468c45d8

                                            SHA1

                                            ef92d9cb5bad707a35928bee2d4db58cc202a84d

                                            SHA256

                                            1f3f689292426d9853da84353958a5392968168b5a1f240f070ec9340c184091

                                            SHA512

                                            3c38f80b639bca6a7c600914f2e3b298312236dd6963f5a2921be5ca6f0023341db240428638e97ce6e05a910f9de8a62d97a18078c36e5330204feec687fe3a

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            46295cac801e5d4857d09837238a6394

                                            SHA1

                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                            SHA256

                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                            SHA512

                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                            Filesize

                                            7KB

                                            MD5

                                            1afa8900623ad7a95faf1339701bdc6d

                                            SHA1

                                            9e87581f9033aee7235e016b990e7e873c4d6772

                                            SHA256

                                            bd749a825257d3a8b3fced26cc5ae3adb71e1bc11c817ae2a84c5e5e546bda74

                                            SHA512

                                            b8c15a5daa8920949fd8e8276a55c59136061edf137ad3630e8123ab4004223fd4c32af962190ce34f65111df5f277d54e9d87dec5efffcbf4e69d718b5f6ced

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                            Filesize

                                            7KB

                                            MD5

                                            5a7971100f585c3a5c04d89f97fa7632

                                            SHA1

                                            93ee8896fc0bf0e2aec9ac84ed1ea4c09b7b53af

                                            SHA256

                                            32d8e98d6b29d79d507d2cdc232d2badca12bcac09383303d486e72f93c19587

                                            SHA512

                                            ee0236ee934932e883d7603d5001137ed5f76139af7364f2827727c74e2e1f6b556ff1fc4f0b6e85d964c801c8d59cd3c41dca259e3d7d0426b65ea542fb6efb

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                            Filesize

                                            4KB

                                            MD5

                                            4d641778ee9f953363d7e60c92b25e3f

                                            SHA1

                                            4e034b74ec9f8fef0795ed36939babca54296a09

                                            SHA256

                                            94a776b3df62e41d6bda870ef31ed39ad08b698b34d2e0dac52bff0b99fe0987

                                            SHA512

                                            c21ad173eed79a84ffed7ed84ca1af57d183b0bab6e698fd0edb964760fe4966849c94cf8b7efb1dcb945102fbc28c1ae89e22a9d56f8066e794ed1cb20b5698

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                            Filesize

                                            1KB

                                            MD5

                                            1f08eaf4907eb38b26952ed96964f47f

                                            SHA1

                                            8f1be31e09a66b23f2b773e0597737c74d4d0472

                                            SHA256

                                            b0b7795f03ba3d389ba8e127616a69039e10ed56aa6318451aa781546464e4ca

                                            SHA512

                                            de4f0619fa77d7c89be86d0a2a3f8add39d0957066ef8da7a9e2d2a023045866c3254b86151f8e92191c52f50c5ddfdf20e7bff45c0580fc5e689836f1115cf0

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            e7c090d50a5a1dac8310764fa97221a3

                                            SHA1

                                            0fd616bf52b48a2d08da260cc0300baba6913cbb

                                            SHA256

                                            ff3dc29570268287e0b04c4866f9687cccec89a3ea0f5a520e54321ecadef1d1

                                            SHA512

                                            443ec8dc8d17c50bfc64f7e5ce879a49c5dc72cc55655e240b9733b5b9e719cfebfb0308b967c7dd9249d2dafc5ca7eb20ac167fc1b14b1fced7c08bcee3a875

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\d8d05327c5274855b1a8796001e4dc6b8f2e344f\index.txt

                                            Filesize

                                            184B

                                            MD5

                                            5b0205fcab1adbb17e3ecf37baff21b4

                                            SHA1

                                            678961e8cffb8b4167347c83f782db63080b4ec4

                                            SHA256

                                            37d9b890504938cd46a3b2c5b76fe5e9a556c11e0d9d89ddc85fbc7d3f2ef1e8

                                            SHA512

                                            80a0aec4b8a97e23a3a498d8ae2a0f68b3b77119e184c984600485e0a6ad5d33bd3d274dfbe1fbd0329649a51ac6dd5bf2a55f7b52758997941fc06fd9013c29

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\d8d05327c5274855b1a8796001e4dc6b8f2e344f\index.txt

                                            Filesize

                                            177B

                                            MD5

                                            f94a5d67c634aa6d413776633b0e0bdf

                                            SHA1

                                            c90308646c093885d699a6b6135b3802b7d7d369

                                            SHA256

                                            6258eb2414c43b996f0898bc35e3512a9d7b6508add9e4948411881a1ad63a3d

                                            SHA512

                                            4b660f9ced48d9effde56a2ababa76418f4a06b2e02753c079b79308dcb0818c603a4a13f1f8b26033080317dbd96d9bc01bf875e612c0257e0b2861526d3147

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\d8d05327c5274855b1a8796001e4dc6b8f2e344f\index.txt~RFe581e51.TMP

                                            Filesize

                                            118B

                                            MD5

                                            df3ec0c9eabc9d4ba7ca6a2a77e85962

                                            SHA1

                                            41bf7bd54e4bcc1068248aced5dfc236e4c15943

                                            SHA256

                                            21590727f4bf2454d31eb93322bf49f09932337b9bbaeb238bca890bceace170

                                            SHA512

                                            2ddf8d323bec6d478fbe370cb0fb0367532f5a9b6c38cd473c2315e23a7734ad0f2bc959da61eda034db1911b22b27e6cd58c661cba3e641f4acae364830c6a2

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b7d1051d-f2ce-4619-b094-c312d5685b4e.tmp

                                            Filesize

                                            6KB

                                            MD5

                                            a507989c9867bda42e3f4a32703eeb14

                                            SHA1

                                            4b7319174d25d40322b67477b7371f6a6a1c7c51

                                            SHA256

                                            e7c940f96334391fe151e6d55375160b7ea5c2bb311c3f8d043a31297b31358a

                                            SHA512

                                            ba3bd6c3ba4e2110d69eeed79fb8faef4f91fd2dbb54559a65b6ce71112f5b59aff4ec2e35f0ec89e9ceddee9fc861c065887e3a550322cdcbcb2baa04edf8ce

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                            Filesize

                                            109KB

                                            MD5

                                            b13783f26979c988a3913bd5f7285c33

                                            SHA1

                                            4989ed06968a5ac2be2e604c09929bd642987d36

                                            SHA256

                                            1a4837764443b22387e8713aaf706bd9a508d1a994ce53553d2ed479914a50b3

                                            SHA512

                                            bbcc0a34a03dfe4673f34e0be974db38fedc5c3ba00e2505e3e56314c2fbe65270c6a96e64d4ec6698dbf8eca8045155cc8926efd4d8dcf9ab8366a849f062cf

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                            Filesize

                                            106KB

                                            MD5

                                            2035ce53e8698fdaf93d1bc428f2f816

                                            SHA1

                                            093a07f9c00c102c7fd7525d5269d6a5a71ba424

                                            SHA256

                                            8b941c622ba5e3a3b4bf4f7b86ada66ffa854dd785888e3b43a308c39941a66b

                                            SHA512

                                            f77e991685d63631f6d034450dad990ddcf1d5efb3a840dcac403929679f8f0ed17f1c4d147f539b3c299706155e3974e345654436161e22889554e0c3b86786

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe583459.TMP

                                            Filesize

                                            102KB

                                            MD5

                                            9d483f62f5011d1ca5879962e5594d37

                                            SHA1

                                            4d418067f701e0debde56965ed31ce14b6ba7248

                                            SHA256

                                            fecfd71a37bef709c5c8f23a095fb0fbe7408aeb159890fabe667c3809218729

                                            SHA512

                                            e51c421af1a484d17ad3a6e048e6ee740957f007e44649d709642e1f156199a0babaf3b9f547e24c4edebb5bba8eab228329a26700238cfcd81b6db1e4948c92

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                            Filesize

                                            2B

                                            MD5

                                            99914b932bd37a50b983c5e7c90ae93b

                                            SHA1

                                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                            SHA256

                                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                            SHA512

                                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd