Analysis

  • max time kernel
    300s
  • max time network
    297s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/01/2024, 08:15

General

  • Target

    https://security.microsoft.com/userSubmissionsReportMessage

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://security.microsoft.com/userSubmissionsReportMessage
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb91f9758,0x7ffdb91f9768,0x7ffdb91f9778
      2⤵
        PID:2968
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:8
        2⤵
          PID:2016
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:2
          2⤵
            PID:4248
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:8
            2⤵
              PID:1584
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:1
              2⤵
                PID:4256
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:1
                2⤵
                  PID:220
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:1
                  2⤵
                    PID:4864
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:8
                    2⤵
                      PID:1280
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:8
                      2⤵
                        PID:4084
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:8
                        2⤵
                          PID:2764
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:8
                          2⤵
                            PID:32
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 --field-trial-handle=1904,i,6629986878679683554,1886487443729139104,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3520
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:1328

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6e177537-5e99-4b74-832c-eb5ef6aa29ae.tmp

                            Filesize

                            6KB

                            MD5

                            c9a80653b88ab389865896db90424033

                            SHA1

                            12de65fd3f4387869221c3385c797be9a0c863e9

                            SHA256

                            51f85061ae68137e84f96d4a756f63ff100d6215a89e629960d0b43ea7de4814

                            SHA512

                            8387d04cafa7e2a047abb329bdb64f7b722ac4216dc080a516b5e2392f5eadfa8e858b27789de69e8d1c5b3528a72967f22ed87344a393c494ac6f13597a2a1d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            168B

                            MD5

                            14abf1d81429f2d679401c0c480c2867

                            SHA1

                            7e0913ac10cf683469c9c4f9ba9c93b99ba29da4

                            SHA256

                            8ce3804a7194be5e485da8f46c528525ff566e2c630f8f8dd5d69c7afeac5fdd

                            SHA512

                            543f32d310f6ad88829589d79bc8e6ef98ebfe47b4b0565641d15449b0b2f9487680cd661422148ac3d81be9e30191cdf33ed1ad530489128df3591f791c9b90

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            959675b8721f463b85ec382d0015afe5

                            SHA1

                            2739ec1ef89d2aab6cc72fca31235a82bd050060

                            SHA256

                            e4676322d1dd74e45ff626bc6580beb0fee3862d4259b4d9df53f6dfab9e176b

                            SHA512

                            b0ed5194ac6ae7077c42659b37899dd0bd57f8ba234c3f568516d13f787b940634bbfa4b0d57b7eae619b4296a674d552e0e357f1b53b00c9cbe642493b238b9

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            873B

                            MD5

                            8157cebcde425233f1d7a728c1450b71

                            SHA1

                            ba6f583094c1b0594b9596e0bf9e1796a657ab3e

                            SHA256

                            5583f2f845855d4923ea0e596d0ef84ac6934618aa7c8c0bf7bd08be062799fd

                            SHA512

                            9151c364d2f88685299ef818d4488ce74196fd6051237b6ced33ff040b0f6cd55788ad3042e7edfb3ef8dcaf31319d065c775234706a0d573478f5c620f99a4b

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            116KB

                            MD5

                            7083c1aa6e1f027bd40177d43541bcb8

                            SHA1

                            de9712b50dbe0a36b156eae2a1d90b77cdd454bd

                            SHA256

                            7ebe11642f97b73a2f629b73e197ae3571469901e1f9fcc0ecefc9939516e789

                            SHA512

                            34c6f71e6bb14e74e38577c48e7d302dda2e5caeb4b211f5d03ef685d6995cea6d51e4c10fb4114036e778385d14d6ad98f635875dc5104628aab01f84479118

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            148KB

                            MD5

                            ade25f25be28f7b97301c834d6c93229

                            SHA1

                            89f545e3186676d1d481870fced022b62bdbdb1e

                            SHA256

                            0d83b385d34ca14e48b7839c7f033453a93a480d50beb9800f9c5c889a1cb64e

                            SHA512

                            9b28cbff4303d9bbeb228ff9a2fe44deca6ea7efb25fc6f655dfe78804e0a229ac267ccf6c3e130a823ee1112e47601b8a5f848ccd2dfe4b401ede3abefa120f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            115KB

                            MD5

                            4f69cb572f88df62131735794f4cb799

                            SHA1

                            c65be8942d604d9753642305b66a32617bc94515

                            SHA256

                            cabac6d94e8d8d99e6675fadd19253dd090243819ae83d738371af4570438093

                            SHA512

                            c98a6c73c899bda3d820ad92b0abcdaa31bd8ca8f00ac96f2fcccb825ad25a99d0fd5a7cceaecc1e98c410806334a6fb8ad00c960325a8f24675590981f55e76

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            115KB

                            MD5

                            bced60dc1d95ad64837223efdd274592

                            SHA1

                            66b4689535d240241e03d493c963f1aff9e14a04

                            SHA256

                            5992b6fa39af760702fea3812ea522b0a24a3040c47c9eca3b5e03a3fd6d39c9

                            SHA512

                            e536f78fac69d003a1c170982b6f54a07a9d34170f2f51ae3bdb2883f0c790d2c6c4a745a4f0d415d92e7ec8a0deebf5e66bb21eb86c9d3984b38790ecec35fa

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd