Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20231025-en
  • resource tags

    arch:x64arch:x86image:win10-20231025-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19-11-2023 23:20

General

  • Target

    https://www.site-shot.com/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.site-shot.com/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:312
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd13679758,0x7ffd13679768,0x7ffd13679778
      2⤵
        PID:2920
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:8
        2⤵
          PID:2760
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:2
          2⤵
            PID:3940
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:8
            2⤵
              PID:1548
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2832 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:1
              2⤵
                PID:1988
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2824 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:1
                2⤵
                  PID:2852
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4496 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:1
                  2⤵
                    PID:2916
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4692 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:1
                    2⤵
                      PID:656
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4844 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:1
                      2⤵
                        PID:4328
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:8
                        2⤵
                          PID:4392
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:8
                          2⤵
                            PID:928
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 --field-trial-handle=1680,i,18099405779061622675,3616732748513540368,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4660
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:3636

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

                            Filesize

                            186KB

                            MD5

                            9f61d7b1098e9a21920cf7abd68ca471

                            SHA1

                            c2a75ba9d5e426f34290ebda3e7b3874a4c26a50

                            SHA256

                            2c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71

                            SHA512

                            3d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            336B

                            MD5

                            1a5ae16b46de3c5213977b067dbac8b2

                            SHA1

                            372781572a532ff774e69ade3067c2e5ce6a86d0

                            SHA256

                            1ba21035a3c0a9bd843a2733da4aca78ff9b2af880fb73de5e645e2375f761ab

                            SHA512

                            5a664fdc7645f0240de95a610d108434649b684810038b85ec005f1afb082bde453f869e969ae40909eaa7322c75fd9d82cd092a5233bbec44860a6a5a59c6be

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            e03549c79e909974f90aec823eb782b6

                            SHA1

                            0025fc2fb13018c9d018ea77e38bd3084c713f44

                            SHA256

                            89094d82e321858e1eadeaa0df77b7cc8820d18d9d5611cab399b58a29687563

                            SHA512

                            8f53214144771ce7e87c0cee255bd5830247782ced84d88ec5582fa6e4b036a0780ad47e51a8a761c50ea3ebb2b5051bd4b708ae884056e7e0398cca565b3239

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            da21c0b8ffa59023051b4785021f6355

                            SHA1

                            46ca0609370a4c37f8f7df338864cb4cecf0d385

                            SHA256

                            0b265bfb0e717d4f307cc827fa3d873cff17ace729edbe93a823fb47c5c3c1e2

                            SHA512

                            009a32c6cd33b658a7adea2385f2ee34c4c0d00d3536881753daa6ce1b132a8b0ac7d6f3bb5157e34d817e7edd2aa58aaa051aa44b962720348a8f4ab24d7182

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            f91a4ded3b1a7d2089186eb51da1a77e

                            SHA1

                            b361fbcd9f8f56682e91c53f8b0c76998d173083

                            SHA256

                            78b6a820e16d0feef078579245732730f97f8e2156547d689accb9bab85a4320

                            SHA512

                            899b69c72233f6d187b19aa8e369868140197629bbd7db5a2953f5eb6b9ef88c6d0a9def68bc282694242c91408c896d2a649f4dd8e9629a62b0315626edf92d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            be8091c2f9084412dae8fddfa7de80ce

                            SHA1

                            e10ff13bec51389af6e97f0f43e72847cc78ba1e

                            SHA256

                            3912259bce6588a2199da351e6e8aa273cd65aa0eb0a9131af7551045aee2007

                            SHA512

                            934e8bf25a1e4de934d9b3eab5c330c88bae6f2d123f026cba986f9e7e6272b5d3147c238ad915c6d2c5039d569fe40d881d00d3acad8dd947c0e2b103c540e0

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            f66736727ca30852ab6f0152494aede7

                            SHA1

                            2c2dfdce24dadb9458d37dcaf97894a1d38fe44c

                            SHA256

                            4ea3bc7ec80a8eb75b61832ffeabe8a5c52b5beb5318c232fa8e52541993c0e4

                            SHA512

                            f6c4113c54e8562ec583822ab26a6d61a04f691d8739cf356443fecf00943031f4dcb3d3d41952c2f685c8384672e1cf9c5fc7dc8baaf70f914abe0e104cae22

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            4760962b3afd0225e7365261de6f1479

                            SHA1

                            ffabafa87581cd8ffa0856997c9428d83c736645

                            SHA256

                            fc1e01697273888d3542c1291481e4beed1ae703b723ed9b78c48b2e5c60d0bc

                            SHA512

                            acc072242142d2e5cb957708553d047dd7cfdbb269216c3b6408bd2c1ac95506735a94aa7986cfbf49b1049a455980544bf6ba69e56bd01d79edf2614c740fd1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            109KB

                            MD5

                            a5fb993c0f74df80fc8720ad65773e34

                            SHA1

                            56b99e61749da8ee7583526480833f72d76890ec

                            SHA256

                            ee707ee1f61f594bf3f1730ac5ddad8f20b789a072f615ba4187d1ad1c57687e

                            SHA512

                            b02a37c3a3edc69b5668d28490994dbeb982cd43b83008675aef635d1ca1a3d043c9f8cf3ce8fc273d1e2febd2b9d91e79f340f77593ebf438beb0e67f32436b

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd