Analysis

  • max time kernel
    2701s
  • max time network
    2651s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/02/2024, 19:27

General

  • Target

    http://globalquake.net

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://globalquake.net
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5ade9758,0x7ffb5ade9768,0x7ffb5ade9778
      2⤵
        PID:1648
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1888,i,15504080451354321752,14830251626929054674,131072 /prefetch:2
        2⤵
          PID:884
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1888,i,15504080451354321752,14830251626929054674,131072 /prefetch:8
          2⤵
            PID:4160
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1888,i,15504080451354321752,14830251626929054674,131072 /prefetch:8
            2⤵
              PID:4116
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1888,i,15504080451354321752,14830251626929054674,131072 /prefetch:1
              2⤵
                PID:1884
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1888,i,15504080451354321752,14830251626929054674,131072 /prefetch:1
                2⤵
                  PID:3472
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4672 --field-trial-handle=1888,i,15504080451354321752,14830251626929054674,131072 /prefetch:1
                  2⤵
                    PID:4416
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 --field-trial-handle=1888,i,15504080451354321752,14830251626929054674,131072 /prefetch:8
                    2⤵
                      PID:2336
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3852 --field-trial-handle=1888,i,15504080451354321752,14830251626929054674,131072 /prefetch:8
                      2⤵
                        PID:1564
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3756 --field-trial-handle=1888,i,15504080451354321752,14830251626929054674,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4344
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:1012

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        456B

                        MD5

                        ae67f92fe22657cb741bec40bfb6bfc9

                        SHA1

                        4b5192d6068ea69fc85ec7ac4ca0412698abbfef

                        SHA256

                        8e0de19ebb49e6b447593a5f03754ed018ad70005805290f1340fbf07e6779b5

                        SHA512

                        8cc275b3606717dc123f3b67c61035dac3dcbccbe3ac364ef5ebd5416a69ab2a223039aeb8497625097fb3aa8ee04d46b4ccc63773f97a47d7cff69c399b6a3b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        859B

                        MD5

                        23e5de17120ee8c484905b61692c1719

                        SHA1

                        f2a290b5d740091d13f564a7ac612fe2d93722d4

                        SHA256

                        8afdad3287fa3699aa8c6e4543b953794a715eb9287cc219c602415609da340d

                        SHA512

                        d92b7bf1c8d3a62594a933bab5f6506787c85c101254a0de3959a45944023099947c6840eb1ad217ed0129a0923824b0c837465ef9929f110c1619b9a3e97618

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        703B

                        MD5

                        f7d3693df9f4e1941d0095eef548c28a

                        SHA1

                        f93cf0ad9856b7b38dafdb44888b76cd8b470f57

                        SHA256

                        c4570cd823b255b63ea43f242a6caa64ea326c26c4a17c4e060b343add1068fd

                        SHA512

                        90b14dcfaf44fcb250a86d487624c6ba93e195e2d68f99ca538d186e12b00df9f21b2453f3e1ea72dcc86ccb5becfa31995de67473834d91a7deb46a071b1c40

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        703B

                        MD5

                        262a91200a9e319a103e87b448d52282

                        SHA1

                        fa8354225b580f693936020f4661a8b4ff1eca37

                        SHA256

                        14f83364649b505a0bfb00a239ef00e4364b7b7084abf9f1ee95343993ea4700

                        SHA512

                        626e8b3c40fbd741a2a19372d070b899e263fab8ae82b95f7c82efc9b9a80fc44d9a7b5bda730f744906a313ce4b191fdc3099a3a28622f1ad07c0bb5da0879b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        b1ae581deebd96d9333dc84fc0fdbd75

                        SHA1

                        ffba40c15b6336a7e66e2d4a6b805f6ab984d120

                        SHA256

                        ee880b9cf82707c9339084edf5a824f4c5682eaf8a5eada1fd9ac7f6ad25abfb

                        SHA512

                        c2c6dcdf346ee890c519e2230f879b6bdbefcab075de9e57c1c1eab792ed35c2d38b084968a55cd4d338a415120544d8ef6d651d375e63670aa946ed8f42d326

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        89d651adf67f4073b2086584837e9120

                        SHA1

                        bca15ac9156bbc9e24b5661f0488abf9027f925c

                        SHA256

                        f4ad324b3e178480f4ca6876bf28ec56d9176d9078a7861497684ecb96bd6f56

                        SHA512

                        91d0afbca4db569050218f0a7e448421d85ae332edb83c7ce8ba9057e365df3945b206606fbe1d41bad2767adf19daa33136083eed3338d37f80ee64be6fe966

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        eab7d0ed7b32bfca533560bd380cd42f

                        SHA1

                        452f7ec7b4747bcb0f81677aa3cdb3b06fea78f1

                        SHA256

                        bf0d1990e830572696c8343090809d28eef29565192bac0fba9d31dc0c4a51ae

                        SHA512

                        8088c426207871ab0ead8237b4875bbf22e1b218bfa1fbec175653fd54b2cd4a89dc7df56e501e65c44247a181d2244ba9d16ff658289eaf4703a1eb4d883330

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\9e1e6cece682cd2cc4374896244476bf243660b6\3f00e541-d99d-483d-a1d4-9fb89a0dae09\index-dir\the-real-index

                        Filesize

                        168B

                        MD5

                        7722f0075bd02490025e667092ffbe70

                        SHA1

                        ebe07dddf849f879df4b6f920b07237b88b6ac54

                        SHA256

                        59c3fd3158cb9c26d73c7ec837c4251d7b7ffc0b1400ec4d21021aa6e63beb95

                        SHA512

                        c08d4f5215ee58f1240b470a0e49c50b76dc5f201be15d46c9fea985b99ffb73c2df6f53aa4d3dafd220e85bf5c0bf0708ca2e680e5994a2a267075bd6696a9f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\9e1e6cece682cd2cc4374896244476bf243660b6\3f00e541-d99d-483d-a1d4-9fb89a0dae09\index-dir\the-real-index~RFe5813f0.TMP

                        Filesize

                        48B

                        MD5

                        ab7dfc4c43f906710db52365ca041191

                        SHA1

                        f75f9c885187056ef24ce850c3628c01d32c1218

                        SHA256

                        f7efd073bb1d9362689ddd5fe2dbc645b64a761e3bd854f076b1b770bcada97c

                        SHA512

                        40d344a96d214a5e02b3bf7e4a0ea22c8e50cd1b4c63aa94f16325d255cf547382ed4a1a4d34e9ff03aafea2564fd4d6787a30280f942be341ed7c3874d48f9f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\9e1e6cece682cd2cc4374896244476bf243660b6\index.txt

                        Filesize

                        150B

                        MD5

                        f4d39f3e9bae427d48ce7a9319d8b263

                        SHA1

                        b876d4187dde540499f55269d11c76255cf52e09

                        SHA256

                        cc89bb276adae720db12cfdd387e5f7aa1eba1c0d9158d68f10f41212f1c3a7d

                        SHA512

                        dd25eed3c225915c49ea2a96a1fd8944d3a68c6b6a657346619c55809ce9686b167e194ffa8b3a40511f498262a4ca01fb0f0adf08a78161279ee97f0ec2b429

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\9e1e6cece682cd2cc4374896244476bf243660b6\index.txt~RFe58142f.TMP

                        Filesize

                        155B

                        MD5

                        c581788d20f3c5efb70420b1103834a1

                        SHA1

                        bc79c294819e4fe9062de571e95322d9f0ca9d8e

                        SHA256

                        0140aeef4a0d8bfcadb228d7fe062c1e3fc5cad613115d983e5d0ccb1fa8a1bf

                        SHA512

                        263566b399088c15da34b939c8a6db2ca60309df92852e56aa72c8db8d830e6a5e907169e7c27f6f8fbd17d348c9dda7f22053e1c0a05604506b8c49a3c3e624

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                        Filesize

                        72B

                        MD5

                        e948aa70f7ad6678e2d1076300f84d2c

                        SHA1

                        e1039e648f1dbca4b8ea9c20a19518c1008ef751

                        SHA256

                        ee0578d8a5da6d741539a56f8c7363ae311de9b95683e6d652d26f5889fad9d8

                        SHA512

                        d5470722656998ca1fb6a6d86b8ce167f1a11e99411ad644bde40bbebeb15a7f32024ff6a98f7df42f812083c6157583e940267a011ee4a79ade4fde474e7316

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5812c8.TMP

                        Filesize

                        48B

                        MD5

                        e37c436ee40e2baec38bcd230d927d48

                        SHA1

                        6c5f1f91aa48ad28baa12ceef39c5c086ea3373f

                        SHA256

                        45b7b2977364979583b5d37b73a8a4dd32f718e10db3daf4ad4dbcaeb4fe6406

                        SHA512

                        72a2cf7141e308c0a59f12d08380abf9c9e7fdf1ed11432417082f28d0bb5b6bd7e1d4941408dc2b9ea1d38e16b5e390cb47d7f85d4ef24c829fd7223ff53555

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        114KB

                        MD5

                        ca806f85b6d8ec7bc36d69221e6a2c61

                        SHA1

                        f1b806f761c37aa4d7fba359c19a9429eae4185a

                        SHA256

                        f44452d55331ce239bdcb33ef7ffa95edce99b700778af586ffea1bfd23a2bbb

                        SHA512

                        f6f948681a77a43a9b19c6ec10612f22839087f0c0aaf1af3ce1ec5b7806557c1037f461b2d9097bb6e78b0c774b44ee776567a7f48b7caaee477b62ae125194

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd