Resubmissions

20-02-2024 03:51

240220-eeqv2sae5v 10

19-02-2024 21:04

240219-zw4tfsdg32 10

19-02-2024 20:59

240219-zs65eadb5t 1

19-02-2024 20:58

240219-zsep6adf64 1

19-02-2024 20:55

240219-zqfvfadf37 10

Analysis

  • max time kernel
    599s
  • max time network
    552s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-02-2024 20:59

General

  • Target

    http://141.98.10.72

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://141.98.10.72
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef89d9758,0x7ffef89d9768,0x7ffef89d9778
      2⤵
        PID:3532
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:2
        2⤵
          PID:4648
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
          2⤵
            PID:4136
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
            2⤵
              PID:5016
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:1
              2⤵
                PID:4904
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:1
                2⤵
                  PID:2408
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
                  2⤵
                    PID:224
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
                    2⤵
                      PID:4796
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
                      2⤵
                        PID:4900
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
                        2⤵
                          PID:1552
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2660 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4928
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:972

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          823B

                          MD5

                          5d07d6b02dd7730481968ca92f9d7b74

                          SHA1

                          3fc1c86ebb599f16efb5c404a7c289fbf87f096b

                          SHA256

                          41d01daff3bf4b38c36a7c61eaeb302b0e0b735df4b9266d97f0d282593d0de9

                          SHA512

                          e22b2d42dc10cbcd96a9a16c1909fb433251d1ffd4a1c73d6cba6583d38ecf7e7e8e3ca89d31bb3b60ee3a2d3ef3be158bb5e6b379511b7ad06f15f1cad220a8

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          27eec39f6e98566e530593762eec95eb

                          SHA1

                          0892492c81a73bf64d23868144c0212d909970d7

                          SHA256

                          569d645918e3fa1fec0040ce46c00db06fc75739e7ad02d740d7e0160b3ba241

                          SHA512

                          c9f8c53d25596850cd534e30f480f76a188659829caa42826b3799a67af0aa8376bccd995b0b7983a266c3cbdb5934d47e6134e3e37030df662528c1be7b6966

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          1388e023fe3072674adcb3d5d35e5667

                          SHA1

                          5f4c0a559d41700f40a7cc4a7214d48231a92e9a

                          SHA256

                          9a356e61d6576da75adaacdc653d5b2d27b28ca06441631258c6012e1bdafb1e

                          SHA512

                          7c4bffc44137963ba8ecfb493f45a01c12d229940c5225f75e53a2bee377e1c3e10061ccc2ecfe5ecbe4385601581d25988da028cb4d3d8f7e03bf75ee282d44

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          135KB

                          MD5

                          0883d9e16188815cb26d8154a9d383f3

                          SHA1

                          c322d30a68513a979b935469d0a9473f0b4eb05e

                          SHA256

                          1a0f6e9c719a59ec2b828372d1c97a8df49e4091ba80a44b6b36b627761959ec

                          SHA512

                          9a6117556ed81fc2ef6221da903585e0277fc184c2c8224ee6159ef29a5680057f395dea5d69db783bc75b3ace711e5edcbff37f6904fcf7f7c7d2cd853ba036

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          116KB

                          MD5

                          f267f5ef60c9debc0d42fbdee861679d

                          SHA1

                          b552e45f0e7db6e0f8a35b3e139bcc6782d8e628

                          SHA256

                          768d2eb22f580c8b1dfdd8b66925993ce088be85a7df8280170664263b21000a

                          SHA512

                          fa6af4ae74906121a8a06a53f1b8166419153e82ef80e30afa9ef9df4de5d6d9f29c35c6ecf02b85943517d66edfe7ba457a56a5fdeb9d8f18dd7208b1da7e91

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          115KB

                          MD5

                          b43d6cac6474f4a9a644f748cc569fa7

                          SHA1

                          467735d82841de9a7318ca5abbd206b21bca240e

                          SHA256

                          51b35aa905f5258a2862020b389a85de3817e5670b421c4b25f3d88664114a9b

                          SHA512

                          991634e6b90290e50348b5063b283210bb2fbdc7191eca4cb70cbd2f7805340564f9483ab9d67240ee54cd78e587956c0cd9188d5a2e7927979c387eb5a009b2

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          115KB

                          MD5

                          f9582fd78495caf46860a858bf4908bf

                          SHA1

                          56040637ff0a3c6a46cd9647fac0336548c40c7e

                          SHA256

                          7f748e617bef9731d587cc1b25770ea80e90ef93db8dc24c41a3fa29680831c1

                          SHA512

                          fc5eb8f09e462bbc1d7079364f29138d9ace90387001434cbc32cbb4d61973862f1a7d6f4a4b485e6c42493c35f9585490f01c1af787508b7c7375fb688c7610

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                        • \??\pipe\crashpad_1632_AXRVSEMBTEPDWQGO

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e