Analysis

  • max time kernel
    163s
  • max time network
    168s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10/01/2024, 02:49

General

  • Target

    https://protect-us.mimecast.com/s/H3ziC5yEz0tg7K93RUz4omH?domain=survey.medallia.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://protect-us.mimecast.com/s/H3ziC5yEz0tg7K93RUz4omH?domain=survey.medallia.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff86aa59758,0x7ff86aa59768,0x7ff86aa59778
      2⤵
        PID:5060
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:2
        2⤵
          PID:3488
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:8
          2⤵
            PID:2688
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:8
            2⤵
              PID:1816
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:1
              2⤵
                PID:1376
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:1
                2⤵
                  PID:3404
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:8
                  2⤵
                    PID:1544
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:8
                    2⤵
                      PID:308
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5280 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:1
                      2⤵
                        PID:704
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3680 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:1
                        2⤵
                          PID:220
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:8
                          2⤵
                            PID:2096
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 --field-trial-handle=1752,i,14931876128918887241,17358020097687261765,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1280
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:2908

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            240B

                            MD5

                            0daf288ff0d8fad6f6e0390a860fb360

                            SHA1

                            9a81745e01354dd027f415b4bbd2edbf36c74be3

                            SHA256

                            4323dfef70be0ab3254b257faf558b61c7a00ce94050cb39da5e318287aecc94

                            SHA512

                            f92247478d1c7cf046a376dc40448f2de55b8569a57a6572755ae8b02c2933511f34c04926b503eac0f32a9ce0e43f46df659ae9f733f9af72c8b185c0c40ee2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            4021c077eff228b4f778a6fc90309425

                            SHA1

                            0894548a681848631ec39395082079c0c480397a

                            SHA256

                            febda7c55f809e18d4187e5979e67f6feebfda908117c3fdfadd92c79aea8f83

                            SHA512

                            8319aa5a6f7b008340c43ac7485a4933ebff1b9732d1eea1a976547434ac387831c58ebad6c1a17eb08cd410568512b4996e293be367f701615459422bc9f99c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            438b917f7213df241ad158b915dfbd45

                            SHA1

                            7fcd82528db2f7cfb19e30888995bd850927e58f

                            SHA256

                            21fe26f7015292bae1f688b2d9b900f7c08426b9f0f7205c90ff1befa6ba5fc0

                            SHA512

                            a83f53e98e295097b9ff5e7eafc18c8eed5336136e1ee10cacb77a59b484b9ab38db76d2aea035d00b5eee5211d040caa67b33dc92338ce2f25e22be0ab7b5a0

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            052a83307618756ffa1965e7c3cf9419

                            SHA1

                            17a23c3709c5671bd653a56611f1769f2438fa2e

                            SHA256

                            ef65f08d9099379e3121ffd89769d0b706fed5d6534ff972e6b1abd1e5d22b30

                            SHA512

                            03d78ab14e2fbdd76ac4b0e47b497da303dfa9c3b2cb864115f41df1d24482f1a85a16809cbbcda49a1b03e504bd867ce976f6307029ed5c8e347b9578431696

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            10f86109f461e3513e9cfe1a095ee85b

                            SHA1

                            86384cd39047c0fb7ddb0276dc46ff9c17a77d21

                            SHA256

                            04e408df1092164ad52695ee1eef76f1bd916c3e53f84ca80e5d356f2fb3c81c

                            SHA512

                            89da52916953a8be7a8d00fed01c9b1b9a679f1555a9980614cf38570202462ad6cd8091c3857ed00ab46c1d556de7f710ea8f5b6df721fe1eb624b97e12fa04

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            703B

                            MD5

                            99883f21fcb068971ad2452cb4c622f6

                            SHA1

                            4c03ec52eef10ae0a2803673ad25d33d0de33881

                            SHA256

                            5e5bdc6ceb7384cd95c2404bcce4772657cd2b12c8d92e33e582966d3a7c8c85

                            SHA512

                            4440fd488ff6a793da0de0b487d9ff8123bc0e0085622bb6290a960d07b920b5b0e9107f7bec7a120eebc4caf51b4114fba970c953f960c5595e9182bf8ea3be

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            c35ca89dbfa12f80c0705d2ffe410192

                            SHA1

                            d81d2dfb6c3a203e084475a5f776462ac5aac224

                            SHA256

                            19160231a32b0fe2f0d822a598c1d0f639cc541cd03163aaea6ebac8c935cb08

                            SHA512

                            9ac50f7d3aed407b9144ac44cceaade38a2990e7eb57d4535b0cb4e11316553870e0d53564b21f6d3ebe7af2a56abfaf08b45134c36b83a918198b3e506a76f4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            2976652845c70ec3818f4203db870190

                            SHA1

                            4e2003d9e1310c846afc838a446f36f0f2c5a7ab

                            SHA256

                            3f9c9e37f8addc32cb51af64ea4619781f974c8d091bbb03ff6037e9d1a6e0d3

                            SHA512

                            8d4ca817b64fa6290ab6ddead9212157aeb012ee0c9099ce87f26e227438b3a3c7e32f8148e5f12eb430c29e0c44c1cc5e804d0d0d2578c3d61588cda7372be5

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            ee79a01c1ececc7f35d6b1bd3146ca03

                            SHA1

                            b7a8ae5a7af608d8499fb8e7309e1c56240057a4

                            SHA256

                            123a43a11cf747d3b2fd3c88f561e64dec04a91e4d5bfd54537555ff0a3797e3

                            SHA512

                            0119d984b029a111889a7f2b213867ef149d14adc18c1c9ccfe46c5278c258982d00d86e394702b20e45f477a9a8320594673ca5138964d806e994b8decdf5a6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            b2e73349b458d94ea224c44c85078817

                            SHA1

                            a07551ea6919a7c42fc8c6e4ae5f98148438a4c9

                            SHA256

                            f6b2dae540072807815c29959e8d95c7ac50bbbeda1377a8cfe8c4bef2bf46da

                            SHA512

                            c21a88ad1b594c0ac8190f10dfef4a3ecada7aeaaa1f2c672731891ea5725327bbe4cba9065f223b931c263db29f7bf55da350c755f9dabfd8463a641f399076

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            114KB

                            MD5

                            bc821cf98855557912d4b9b458a8ccd1

                            SHA1

                            cbdefdf0ff678ceef333c679ec7615fdca905631

                            SHA256

                            1e58091d6c463088b3b04c06cfa78afe09df3a300ebd68d818e26ba3f944ae1f

                            SHA512

                            6423bd0a6510be0aba4630415dd80028dbc95186cf4a554456f8fcca4f1b8511d5a1cc77bdf7da7646aaa4885291e6be595788ce2e620ef106b7e442a7d8b4e4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58b90a.TMP

                            Filesize

                            98KB

                            MD5

                            7fb794722052e90a78775dfdbc171f62

                            SHA1

                            1a99df294768729c4dfc8d219b9ae288d1a6fb96

                            SHA256

                            109c343d09ec7bfeddb9e28212ec9a3cdf83e53f4bee73931e0ca5528f6432b3

                            SHA512

                            205a3e9c4d8bfe06bc53431fe8e5b8494b461b0232835c889cdd2602b726cb36ffc2a91b9e6b1eec43c6db37d1d7d848131fd00afd13d3b2208d0d8fe20898fe

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b528b3be-bdaf-4fde-8a21-7cc35ddc4610.tmp

                            Filesize

                            99KB

                            MD5

                            206438a4938dc03cdc44e0759e41441d

                            SHA1

                            922382fc76fc63a88955647e3b6dac6f096f35e4

                            SHA256

                            9ffc1825b1ee43bf318c5935d8be01f9f0bf1a517769eb450f6c62010f5171ae

                            SHA512

                            3b84d13facc28bef010d17e85646af9c718da8616ff862db24e5b03e8a6f5e21e2ae0960dab0c65858c47cef020bd5a76f5fae95ea0566529120393e759e87f7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd