Analysis

  • max time kernel
    41s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-02-2024 14:08

General

  • Target

    edit.js

  • Size

    55KB

  • MD5

    3d194446ddc35c9a86ef1bd03a0204bb

  • SHA1

    0a710f632abde2d02262573da64a62b127ab6ab4

  • SHA256

    cfa12de832b2a2d9f4689d04ac6d515629b87b0632e75c9c88400a92c0c1944b

  • SHA512

    b1231b266ce9ee7efe329c381931883c522144d2395a769ed2f60b9ebb083fb238b96de99282a452766802a738931fecacbbcc1dfbac842bb5333b19b63de1ea

  • SSDEEP

    768:cc9WWXD1OichQPLpsDq5ORoS2SNMEDm8N6HF/FGNNKxugk39AZ1pFpVl/EVIfnA:P9WWXBOxSPSW8N6fGNNKEgkNy3TfA

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\edit.js
    1⤵
      PID:2656
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5564
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe7df19758,0x7ffe7df19768,0x7ffe7df19778
        2⤵
          PID:3088
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:2
          2⤵
            PID:3580
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:8
            2⤵
              PID:4108
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:8
              2⤵
                PID:5832
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:1
                2⤵
                  PID:6040
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:1
                  2⤵
                    PID:5188
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3784 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:1
                    2⤵
                      PID:1568
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:8
                      2⤵
                        PID:2024
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5144 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:8
                        2⤵
                          PID:5200
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=1888,i,8106363068190225351,4706790841516855306,131072 /prefetch:8
                          2⤵
                            PID:1744
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:32

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            371B

                            MD5

                            551cb1653c7640ea9748932353bfe961

                            SHA1

                            3238c9916cb29f83790afa5de29636a9d2b8874a

                            SHA256

                            4eb05831534c4d782d68370edd5bdf99f8d52ca58680f9160571dbe152219f0a

                            SHA512

                            e2641d4bee436cb2409426fa88794237e881ecf05f4015ebeed49b48aea72e86496602026f61adc888eb401c13e6f7f78469ec5aa50939dd405f9c91c8e19070

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            96c41a86d81a8fa96f0202c6a275d971

                            SHA1

                            4b48cda08cb7421266aa6c2328102bd88888e158

                            SHA256

                            dd28df275a19eb98dae4593db97cd54a291242a1fe061239e3322549f248cd7f

                            SHA512

                            3d4a9d3e80680890dd3f7885d3670db2a08abb0c703eb76ae0806d7f89d40079d7b8a95f51eaa04b00db56f2fbcc0961150b5fe9e98463fb57da2fb3004633fb

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            240KB

                            MD5

                            f2fded2a28996b78e03b0660251b45a8

                            SHA1

                            986e980f29e635921059fca80d548faea57441ad

                            SHA256

                            1f926950800ec2edccddccf4dbd6585c75f1f0adda4afcadfa29e334a818cb64

                            SHA512

                            382aa83c89332d3c80655550a774d2f35b392ae5becd4c12c4d7487b432ebaf0ce6308d95e00993232fd25153663dc54a55576c6b7325bc918ee83e57aaae105

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd