Analysis

  • max time kernel
    599s
  • max time network
    590s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/02/2024, 16:15

General

  • Target

    http://www.spectrumbusiness.net/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.spectrumbusiness.net/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffebdd89758,0x7ffebdd89768,0x7ffebdd89778
      2⤵
        PID:3676
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:2
        2⤵
          PID:1992
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:8
          2⤵
            PID:3400
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:8
            2⤵
              PID:1824
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:1
              2⤵
                PID:3036
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:1
                2⤵
                  PID:2176
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3760 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:1
                  2⤵
                    PID:4960
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3276 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:1
                    2⤵
                      PID:800
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:8
                      2⤵
                        PID:4268
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:8
                        2⤵
                          PID:2732
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3828 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2804
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5428 --field-trial-handle=1812,i,1155427993959011861,9561737429751918384,131072 /prefetch:1
                          2⤵
                            PID:2648
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:4672

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            336B

                            MD5

                            1800363f81ce513750df02c1c4eda17a

                            SHA1

                            e69573932ebd9c285b5f9b6bc37b7a0ac88a80f4

                            SHA256

                            6cc5c7a88ad49702b5817dc6e9ba9866d20c4686c24faa88705539927dbfe094

                            SHA512

                            c915ba465e2c9ca4498e524084b2dc7b34d6158fc34a539f084eb818c490c8187183f4a92e25129b29b4754e1d8de54917c1d99bcd62a6b8d1b1fdc5ebe7a896

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            384B

                            MD5

                            b235ec2f4410f1bbcbbbd50a51d108ac

                            SHA1

                            bd14869874ce77b3617adf3c8a696cceaf6f7dd7

                            SHA256

                            8875c3ec67fc1104330545d9e98d439e902c4b4f3de6ade2002559f0651ba028

                            SHA512

                            2e375597c740f8340f464894fca81420e02cb1deb5104d72fe662e55057a01be28b067354cc6b658fd7afcb5369a178cd7f39b3363c94fd134c11c0670421462

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            c5ed64e0ed45579474a8e7b08ce91a8e

                            SHA1

                            68594d3924bb08c9196a3f6312396d87b4d9838d

                            SHA256

                            e317d497ac4271620b4d98b1208134d9b5ab97cedad37069ab48f9097cd10269

                            SHA512

                            b139722a4eb5b90a51c36b719d89bde3b108bc609efe70762510413519ef6c38027e8487857c2695aceecad1c6b3a9be2baeea51bc8226d8e83314f05f55cf5d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            48d7b2991163d7b1b7702527839ae8c7

                            SHA1

                            9ebd143f13b1db1082d8091c377ede59cbcecdf8

                            SHA256

                            3b1ff4afb1b9be882507c8b5ba283accffc884cc12542c15aa6d40426dd37e59

                            SHA512

                            37c621e395cdf079de2e8a2bfe1c8abd4226e284d66974e71af7eb153750510352a9771446f9943795679ef961bd4eac65d658dd4b0ea6a984a66ba6f73a31e7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            d9afbcaf49281511e1a28ae4f750c75a

                            SHA1

                            731fb69c6e1a311d5e6c3b2e5c22b38e32934290

                            SHA256

                            c41b5b8b0cfa08706e42cd18246fccea748b89301fdef9aa4f28312c3022eb29

                            SHA512

                            dc8897194410ea42672d727832ca1d0696cd501129f7ef37c0080cc3d6a93b70746edd1bcb256cc5d931e40c7fd0d761c4607dc3d261cc99d69093856a7aa76f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            976396ee5363f05583ea4c51d0b89298

                            SHA1

                            6eb7f7254ce9021f339e24bd07060087805c1bc7

                            SHA256

                            baa0574862e8538e933d3a249a192e72dfabbe6614ea4c1dcb7b28c07517e7fc

                            SHA512

                            e84489469315b6b6342e637356bbe53a312c837012796bf1d4d3776d3cb344fd3de5484e573fd33ffde2ee2eba79add38da644e0ab90839d90223e5fcf98ffe6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\6775aa5c1faa52f7684af09b9b05f002ecfa1af4\index.txt

                            Filesize

                            213B

                            MD5

                            d7db9bec996a82c303ef5fdc67429dd4

                            SHA1

                            940edd3c6837bc162309b75e211a5cf65f1ef9de

                            SHA256

                            ed67313f39ee7f674381687353dbbe80f728b2863428bf44e951bd386050f4eb

                            SHA512

                            82d7e3dcaf42cbf84d133f139e2ce64d98122c8bda4c81f9f35220e88a20a89e6d356be7343fee6df00d357315ced64201efe32c1c8ae3ee89f4f375452d9127

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\6775aa5c1faa52f7684af09b9b05f002ecfa1af4\index.txt

                            Filesize

                            199B

                            MD5

                            365d045ee8bee18bb30c5866a23d46f9

                            SHA1

                            7c87fe819ee9cccaf95f2a5edf027b730a321f55

                            SHA256

                            e903f7a671f3e8bdc69f0cf806de2e2a91c0da16f4f03289b9d112d410bd463b

                            SHA512

                            bc1047ffafe2d856e2cfbffc5cbd3dfe6aa390b2c726eb17c690de112884f2577e0624a4a3db3d7dcab857c9c133cdb9784e980475e39a16290bba65f52fb09b

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\6775aa5c1faa52f7684af09b9b05f002ecfa1af4\index.txt~RFe578879.TMP

                            Filesize

                            140B

                            MD5

                            3ced3dbb46d3a43295af0e3318f04f23

                            SHA1

                            1103f2a99e59054907c400fac085ab1f7440fcb9

                            SHA256

                            e744b535d977e74e6aef4708aa6f4355a94beae8381ef6f8ae7ce35dcc48e12a

                            SHA512

                            bbc679ee3b2e75a79b9ecce9aeb4d1becefcba3c0bcbc2583227833d5edebed6d0ab2fa305a98a5f3a2eef483ee5bbf992a02fb16d59e79c46eeb31ff6c4d28a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            129KB

                            MD5

                            ce1f2ab6cdab4b9077fe61367a056fdb

                            SHA1

                            db358d29a9c9618e55b1e72be903b40789092a95

                            SHA256

                            875bd274460279901608e4c1c4c6e4aa71e0e15084bcc8cb2ebda9f871fdd740

                            SHA512

                            e0990a4444ff8701801ba99fd6cffad667c788077a8e23485219a6330aeef220780e18372ecf1bde88bf7438a59df095c7d67adc7ae350ba4abe587cebaaa9d5

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd