Resubmissions

11/12/2023, 02:09

231211-clncdsbeh5 1

11/12/2023, 02:02

231211-cggdaabdf5 1

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2023, 02:02

General

  • Target

    https://scheduleorder-error-0559.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bf569758,0x7ff8bf569768,0x7ff8bf569778
    1⤵
      PID:4492
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://scheduleorder-error-0559.com
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1832,i,3072510101643713916,10403163058078951744,131072 /prefetch:1
        2⤵
          PID:3060
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1832,i,3072510101643713916,10403163058078951744,131072 /prefetch:1
          2⤵
            PID:2980
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1832,i,3072510101643713916,10403163058078951744,131072 /prefetch:8
            2⤵
              PID:3024
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1832,i,3072510101643713916,10403163058078951744,131072 /prefetch:8
              2⤵
                PID:4792
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1832,i,3072510101643713916,10403163058078951744,131072 /prefetch:2
                2⤵
                  PID:4680
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4524 --field-trial-handle=1832,i,3072510101643713916,10403163058078951744,131072 /prefetch:1
                  2⤵
                    PID:228
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1832,i,3072510101643713916,10403163058078951744,131072 /prefetch:8
                    2⤵
                      PID:544
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 --field-trial-handle=1832,i,3072510101643713916,10403163058078951744,131072 /prefetch:8
                      2⤵
                        PID:532
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3680 --field-trial-handle=1832,i,3072510101643713916,10403163058078951744,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4480
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:3108

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

                              Filesize

                              196KB

                              MD5

                              c1b5e073556019fd1c72a1de270ea87d

                              SHA1

                              b8f236518eacf71251c1a1db7ffb66b2262fced1

                              SHA256

                              1858bd5077bd48b59198fc991ef79e88d190850db01575e269b40aa0eb8ee0a8

                              SHA512

                              6064617f03e0ba20d97ff8b3bb53104f52cadc0445686bd27058ae8498a8cf523677e0c6e2bedd195b0d36e8b47994653197a83e7a2aec03d9afbec22d1b1a13

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

                              Filesize

                              30KB

                              MD5

                              ca6e0dcaf6fe11e3b4d4d299ecbab7a6

                              SHA1

                              a637b13aff3baacc733eb221226c36b71a3d3a7b

                              SHA256

                              f4a93cf3834c5f3bbbab2ba619425fb1415050a847f5bc12cd6b0bab5e68074e

                              SHA512

                              fa037f9ac77644d641bb6cd1b18722be3cd7d039738f8770d6a09cf7e5829b1602a772ab643ce8cd683a0d11e62c5ccabbd555fff25f77c39034793510543ed9

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              168B

                              MD5

                              c4e4dd8adf94bfc65e5ab862e578b98a

                              SHA1

                              07d22184b7e64b3a93389162830f85dc457b224a

                              SHA256

                              fe03d2e003ae5e29281f98df67c54e1215eb1e974780f82db3040af29754e6b5

                              SHA512

                              b403e9da04ff915eb5111f17dcbcac4375de1e14a52b65184849a582169c3e0ea85b7748af93e7716caec43db905f07ab6fa9319db89bcbe8aad871bfa91f7b5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              216B

                              MD5

                              c7837d6e6258cd29628c4ddc8cb38dc4

                              SHA1

                              f2de84f4721468c76025bafc5c20f1f19fd25a0d

                              SHA256

                              448a18d698e55c3ecf49cce9cf1928ed97acf4a1070dd6a3bc4a33ffeb2a614f

                              SHA512

                              4a5e4ff2dee6dee2fd4a4cc20e34ed94e58862928491fd4f084140d78844f1f19a27cac51a646a9c290125075dc9e433bc897987329542816da12f5dd1661489

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              1367c85ba5c6ace1816c2c4f335af989

                              SHA1

                              b1cce561d008c63b23162371b99e961ac1b0e300

                              SHA256

                              d1af8199c6f490c1fdcf203b7be05b4aa297576887b71772838c623f8696561c

                              SHA512

                              d14a09670c655dc2ff6190f1e375075e60ee8c77f98350d38bbd37538abe8884eea2980e0dfb5dcc16118789197d9d8b02c5e42014f3bb3c355a1bb4997687bd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              31edee51bff423381bedffabd0316e7a

                              SHA1

                              bcc5ba2c984dd8bd43f7c52d0aa51b620d38fdc3

                              SHA256

                              25585330f39a3b54ab92fe883354473dd58f0df40c96b754adef7133600d71fe

                              SHA512

                              9e39059fe24ce179b382fea429964b590f62306bdb91203bfd14737b6705d1c2210c7cf7a7513ba3fd3fc7c2e6d02335e7a3469ee69109f3df96c189f6609e7e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              9cd7c61840e4684f828cce3b063cde76

                              SHA1

                              bee85026a3bdfdef6794a03650310daf86425190

                              SHA256

                              ce43d39dc5d1c04a62874b2409b6a89887900710ec8d3607a0576660d6316ad5

                              SHA512

                              a9807886d1a153a56841956e11fad0a1a74a48de8468e908ca0949a1c5186bb373501a3bbc406d852a34a5a42b8833b2188ae030a2e344efa62db0ee6b0990a8

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              f463914adaac8409ae5db961c7bb5db5

                              SHA1

                              b54e9bbb932f51f5f0b8fa9955af916cb036f1cf

                              SHA256

                              02a26b24d851e5e9edf11a2f9a39a77e1f5c8bde445328c07261680f45a62107

                              SHA512

                              e4a1c85fa5aaea7d27d25659a02cbfe45dabcc3ca2238c4b2d525532e5788541f1a2b263be442b21e1b0ab667b51ed8c40f1d0e1cd0e0998d7de45c14525e8f7

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              16KB

                              MD5

                              cdefcb8d43129ae6adafe9a327753b07

                              SHA1

                              18a018182efc9556ce79d78eda3d9f05ff8a4c49

                              SHA256

                              2b8bcd385e713d342e5ef1330ba7cd21c00b118ed4e164ed31f9d3fdc84d5f85

                              SHA512

                              a9a4419e9897caf8d4ec2b440bf56ee82477d0ef389a32bcfac1463e9f3aff805cd6e81f3ddad3a8a4738884cac136f2665dc0137e03be3a730d6a92d6de0843

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd