Analysis

  • max time kernel
    178s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2023 23:30

General

  • Target

    http://ChCsl.com.ng

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ChCsl.com.ng
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef3409758,0x7ffef3409768,0x7ffef3409778
      2⤵
        PID:1832
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:2
        2⤵
          PID:1372
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:8
          2⤵
            PID:3324
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:1
            2⤵
              PID:3904
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:1
              2⤵
                PID:3412
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:8
                2⤵
                  PID:2784
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:8
                  2⤵
                    PID:956
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4688 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:1
                    2⤵
                      PID:1932
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:8
                      2⤵
                        PID:676
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 --field-trial-handle=1908,i,2670074986219352467,13492856648003378665,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3556
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:828

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        528B

                        MD5

                        4a3297fdd1650a409f9cf0c37ad8da5e

                        SHA1

                        87636a97c97cdbe04a9dd9a5274d4cfa5025903f

                        SHA256

                        e00b5ef1084b751a290ddd9f7ed385d76d3113cc94e8d50863c24b1333f05561

                        SHA512

                        6cd6ccabb3410848b1261c25d93cbf297f482dfbcef006d27b758662ccc58e387cf732c2268ae76415b555ba589dc931aa8534bad2e4f939529d0c39d6daab64

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\486b306c-bb79-4b59-8f41-ddfcc21f92a9.tmp

                        Filesize

                        2KB

                        MD5

                        bcc39c156f815f75b39cacf3bf0230fa

                        SHA1

                        ffe9a5feee57b6c0a1f379c73575231d61e5bb0d

                        SHA256

                        97fef9446383bbd32c167adef72138e4139c8197f03ad25730011513770aa1a5

                        SHA512

                        2ecc299b5d839e39048acb1e6a1875cb90d9729800e45e16038d1148419a09cbd6a4f9e59f3d0deb848309e9d2a7e95f628cc7d1d45f4b7bbf35391be18f0e7a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        997eed2caca35cd1c60214f9c99db361

                        SHA1

                        70a58d2a3837bcf2774d667212fd46074ce92b03

                        SHA256

                        7d029807476b27033bd429437b2514810c878e0d9472052f22c5bd3ed3f914da

                        SHA512

                        2f515d1cc63551b9a87b00f5ea0bbe632dcb05567bd94bfd4c9eb3e3ac61b6236c1247737410cae2be38b26a613407e71bd7e114ffefe82891648b6d8ea819b8

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        7e145924bed43ef0c87c706e91dd835e

                        SHA1

                        950651ca75217107b370697965ce8995338ecf8f

                        SHA256

                        bd559ef00d12890e0fa81569b2cbd42027809b6a25e11534125ad098106f2b1d

                        SHA512

                        e2d48a62cfd115bc2317b5c169b29839d74508fc5f2a519e353b0ac529ad3a0c860743dfcf3d2eec67e1b3afb2d3a51c98e1855565db3991aaea4af585585d35

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        c30bffcc26c5ef5d3ebfcf77aa69e703

                        SHA1

                        47cd646de0387fcc1dff8ccaa2013d382b9ad987

                        SHA256

                        ba133aad8909c955db5595a3ad19c7eae5279e941d9ef0bebccd107836f47df4

                        SHA512

                        352b60aec0558eab3e7dbe7b585cfdd9ef20c946a21a5903b4d044ba6a547919c6e0b6bad54ffa6fd1599d9d041313bf509aeabcf05c79f7f3e4b79b779a72e1

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        539B

                        MD5

                        a08d42c37688efb65fcd84e456b67c27

                        SHA1

                        80ba661d7710da4a91247e4ffec6ccea4ad02aa1

                        SHA256

                        44189e524f001f5b2b64ab5970b2d807e692248cd8c30b4e984bb7f046207714

                        SHA512

                        526656cf7b8c47996f07350b237fb0e4dee4eaa68aaddb5e88803d513463585fb8f2ae6670d3f66a30a82ebdf313c10a7ce0d25ae63568d8a207c78cd9b2ada8

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        7673d27772321c9fd9c5f3d6d157fbab

                        SHA1

                        0e3919941f2ea965a33caadab3165f8f72eb958f

                        SHA256

                        017dec12a8f644a36a0a58e06773b40e6d779f4c71cbc42c396f70b1449c4c02

                        SHA512

                        a17fd2b93d4bcd101f16802a5f0877a42c8a28b4ad5fac5b1e0f432e17aeebf69d316d80b35b243710ccc7e99776779481da4921fb830b2a0124d82f625032e2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        c7d8c450e895a476af672a07b847796a

                        SHA1

                        81d1aef4c323f2abbd11a2f7413ce5a1a62aaeae

                        SHA256

                        255fbe70d241c7bd803bad4e77625ea849974feed22994c7af6b88dcc9f8ba92

                        SHA512

                        59514f80af5cef3df022bf5f91790aeede97fd3503b3c6b45659210ce17ab499ef08693e663aa6df93d1e1a10022976a06c314234482c62fd62cfd7f66fc973d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        214KB

                        MD5

                        210327dd9af8787bdb08392cdb0cc651

                        SHA1

                        7334182b8d1798a99cdaea73918a42ec6ed4da38

                        SHA256

                        6eae68ca5b387b5778c4648068ccc34db06cf8c9ae1ca3c96e65d77d9cc2851b

                        SHA512

                        fd6413b121d40d9a5c29b7f1fb136caf2c900279f6c802d002caf3e8097b59117053588f48f81b81e7d41810240fe5150c9dbac551f2e6d96aeed05fbdc49832

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd