Analysis

  • max time kernel
    299s
  • max time network
    298s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 17:32

General

  • Target

    https://protect-eu.mimecast.com/s/SmNWCpQw4cn0WLVqiD26Bi?domain=emailmg.zoominformation.com

Score
10/10

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://protect-eu.mimecast.com/s/SmNWCpQw4cn0WLVqiD26Bi?domain=emailmg.zoominformation.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4176
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff96b9758,0x7ffff96b9768,0x7ffff96b9778
      2⤵
        PID:1040
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:2
        2⤵
          PID:3084
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:8
          2⤵
            PID:3032
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:8
            2⤵
              PID:2284
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:1
              2⤵
                PID:1216
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:1
                2⤵
                  PID:5088
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4716 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:1
                  2⤵
                    PID:2940
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4996 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:1
                    2⤵
                      PID:2060
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3228 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:1
                      2⤵
                        PID:2540
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3260 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:1
                        2⤵
                          PID:4480
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:8
                          2⤵
                            PID:4284
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3264 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:8
                            2⤵
                              PID:4448
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3784 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:8
                              2⤵
                                PID:2564
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5524 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:1
                                2⤵
                                  PID:3904
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:8
                                  2⤵
                                  • Modifies registry class
                                  PID:4788
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5552 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:8
                                  2⤵
                                    PID:4020
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1828,i,5445014102350314258,16797201116348284632,131072 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3292
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:756

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    1KB

                                    MD5

                                    cb3558418b13e87592f69bddf9ee097f

                                    SHA1

                                    8b805eae9912e38f1eef5489071377552fa784e4

                                    SHA256

                                    320b05a34e603ca6a026618db89b4e618372ad3dbfa41678d94331891b6f3fc6

                                    SHA512

                                    90820a5e0eec67dddb501593f54fcdfc4dd607441255c47a0279c89cdc44db51ad849264ef68b353ee2e9102ea63c93ec74a394abef9ae83d3b757d5a0f505ca

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    7KB

                                    MD5

                                    ca6a513a59d554a15fda5080ab64a4eb

                                    SHA1

                                    6db0ecdb683f00f750c52af950d9df45478650ae

                                    SHA256

                                    908e12d073ee40120359676062b2240a2deff0b72890f7b0e048f6a3d352fe5b

                                    SHA512

                                    d26e06ac3aec021c7de763a3f81f245548305422561c3973797e6d37485300594984c99f0496171869f12b9c9dc89907f69b040164e81bed5746ff67c70c296d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    8KB

                                    MD5

                                    eae78e135d73f7f42d1d240dba269b41

                                    SHA1

                                    8aa2f8c593227a96d8463c310c619725b43278d1

                                    SHA256

                                    847450eef6f778747cc9af66a668b375f8c84becf31872a4bb6e2b7824773f84

                                    SHA512

                                    7db9afb880c9d583a0f288ecf464c72199df2a5c060a14c7368dd956f14897bc9cebf8d175f3c26566fdabf9ad2493663a0aa9beda81d18b81237c2d7cdaf10f

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    50ff8c853e8a1ff0e958eda07ea2ab7f

                                    SHA1

                                    398d25e319256be47563bb956c8dcdcbcca216dc

                                    SHA256

                                    d021ede4378a187af6358c549cc8e5ad0f8947f9bc09da5e54376cb29a03a075

                                    SHA512

                                    1c4e8e8d4afacfc3b96da421bb79c019b142a845b2b88c1975b3ec1304f15977bac693201faa1f1d2a661903e7e9c9fb0d05734962d89599030ea22789b5ddb8

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    2KB

                                    MD5

                                    185fd40be1df8d8bc0ecc8c17bfa59b6

                                    SHA1

                                    73a6e0f4d21f02f02bcaee823f4eac621e1eb33f

                                    SHA256

                                    fe2f74f13f2e3afcc148729cbbab0a9da124a54ab16c1ff0cfe947aed74bd0d5

                                    SHA512

                                    bf198d4605621c5d6a9233b7e0ae785155ce91aabbe1279e15861758a23d7880953e8fa6c2ba663e926a31a75e2dd0525192ac7521cd1f579803c8ebd9582b0c

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    fe3d17ccd0d11a3b0ad7944674fcf947

                                    SHA1

                                    a552415c2b0d8265d077e29a1d2e0c16e50d3626

                                    SHA256

                                    9e21323afa290619e02d18a4fbf11e3b68eefa130af975547fe552e679509e66

                                    SHA512

                                    100bdeac1791ac9e42265951d6de1e4088b0b9119e2176e607d421864f141965b8d537b11e6a5d8f32a9be8bc298e416259fe65fc46c846b12d8d01b08ce3723

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    2KB

                                    MD5

                                    c003cebf435d80e675e651a0d909ac63

                                    SHA1

                                    0b3f35513098d494e14bc9796029f8802df934a7

                                    SHA256

                                    46227dcf81b68ff9072c587448b5a897c97fa01e273bda44867eef4f8708d861

                                    SHA512

                                    62e27d812558e1ef76ddd2fae736d98470cbe2e66109b8a57f4fdcd057bd1187f435ecd88ee70f5cdcd6f5b700fec9b022d34ad9faee93ad07c186cd1151b003

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    2KB

                                    MD5

                                    e4c03a35f6e6f81a51f343b7cdb8b70e

                                    SHA1

                                    4cd843aa6c37074b724aed2131c28a4422bff542

                                    SHA256

                                    5a102cf5a64c824d2397a12d6884f01018d4512863f369968998b77ac7fa9c48

                                    SHA512

                                    56cba02f2c4e11fe6a6da318506a2027b9894572e59af046a70f3b6e54ee5a8a432f1ace98d4253d326292f86fe2d5ca112f273a7f370a227ec80eb853bafcb1

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    2KB

                                    MD5

                                    4fa3f089b8f824bde6c0bc0fd18019a9

                                    SHA1

                                    22f582c0cbbb7a37f04cb4876f43526a1d451437

                                    SHA256

                                    1ad5593c6f058ec7c16a2b9c7487e4b1c1f1ffc2909e387de1ea0eed612b9911

                                    SHA512

                                    3065fda16079c3ffb898bc9e6225a062f5e0c551e46f08e8d68bccbcf28834ca29905dda0c6310d13149e0365e877dd5600d53d4600e249f8c9851bd883471f0

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    9db9557bc58ce1c64e726bff38573dba

                                    SHA1

                                    8baeb181ae9a703555f413a25f0b8cf281ececea

                                    SHA256

                                    b7a805666d31c9eb04b5e92bd56bfdcbbec4b544abdd7e72513cf4eece01e374

                                    SHA512

                                    43d3e69fa53bd79ca30180a9bcb2e97e998b5d89a85479e7c5d2b180ee6921e888f5783bca43bbd660451430ccc01e8d5b01c1d6e37b3ebba405fc3eba674a24

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    8c798ae0963a1dcdff593cfa779e460c

                                    SHA1

                                    5f15d626e448f57a0942b321db663ea94a6d0406

                                    SHA256

                                    f52cab881f0c2b31a8bc1fdd9fa377234d7d95e18323b76ba868fffdf6774929

                                    SHA512

                                    dcc918895aefa34354da26255174a24db896e07efb7036b33162b6aa8a3ba050573fff5c6877de8bea6531b5b68ba304eaac844721e54b8d3f15b1a13e188612

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    114KB

                                    MD5

                                    c8a524053c873a5eff67b637f912dc9c

                                    SHA1

                                    dc88ff418da5434a44aad4fbc4067a9884af1067

                                    SHA256

                                    62f124d1eb29a69bba0eb3177dddfedfda5ee2bb6cb6bd5da3e87195aa80ab07

                                    SHA512

                                    bd73e54a2661ab2b6433fb976553da3b47a2d6a3b86d5690f05738af9ffff8f7228a1d9200f626ca0ee3c458735139d9c4458be64e5e672395ae4365a56b7c4d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                    Filesize

                                    104KB

                                    MD5

                                    0e8fd027a734f7ad0f0fb3ff3c410a24

                                    SHA1

                                    db01e2db7d379f9b72717701ee1a65a77553f9ac

                                    SHA256

                                    83f3b5cf45d095a7d25fa73f847080d013b81fd82cd2142eca8e7da946c0fe97

                                    SHA512

                                    666153f46e9e54afb21413fd93e02701b52c7518c96eef37b1d729adab0f95c45298073be83624c0569d301a2c47bd5df4350a6f80957a050ec22afb520e2ea4

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57bcc8.TMP

                                    Filesize

                                    101KB

                                    MD5

                                    b9f7927acae00d7997e77501a382f9ca

                                    SHA1

                                    eef54b8455c0de2c42230dbcf56e6b1a8e463d33

                                    SHA256

                                    5af405d9aef746dfa5a99a42c5f7e6ff46703b0682d3e68042c03a6f990b6a9b

                                    SHA512

                                    07079f7deae9f273d39c7d7d4db47e0b321e577efe83c49092dd5a7b0e6fd27dd3685651c08b8ef9ea8cfd2780fa89e1d0d4164264cd4b5200743c66d06dcb62

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                    Filesize

                                    2B

                                    MD5

                                    99914b932bd37a50b983c5e7c90ae93b

                                    SHA1

                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                    SHA256

                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                    SHA512

                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd