Analysis Overview
Threat Level: No (potentially) malicious behavior was detected
The file http://141.98.10.72 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-02-19 20:59
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-02-19 20:59
Reported
2024-02-20 01:58
Platform
win10v2004-20231215-en
Max time kernel
599s
Max time network
552s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133528673031845990" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://141.98.10.72
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef89d9758,0x7ffef89d9768,0x7ffef89d9778
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2660 --field-trial-handle=1924,i,2493241553464518662,1428663115132373917,131072 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| LT | 141.98.10.72:80 | 141.98.10.72 | tcp |
| LT | 141.98.10.72:80 | 141.98.10.72 | tcp |
| LT | 141.98.10.72:80 | tcp | |
| LT | 141.98.10.72:80 | tcp | |
| US | 8.8.8.8:53 | 72.10.98.141.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 180.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.109.69.13.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | b43d6cac6474f4a9a644f748cc569fa7 |
| SHA1 | 467735d82841de9a7318ca5abbd206b21bca240e |
| SHA256 | 51b35aa905f5258a2862020b389a85de3817e5670b421c4b25f3d88664114a9b |
| SHA512 | 991634e6b90290e50348b5063b283210bb2fbdc7191eca4cb70cbd2f7805340564f9483ab9d67240ee54cd78e587956c0cd9188d5a2e7927979c387eb5a009b2 |
\??\pipe\crashpad_1632_AXRVSEMBTEPDWQGO
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
| MD5 | 99914b932bd37a50b983c5e7c90ae93b |
| SHA1 | bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f |
| SHA256 | 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a |
| SHA512 | 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | f267f5ef60c9debc0d42fbdee861679d |
| SHA1 | b552e45f0e7db6e0f8a35b3e139bcc6782d8e628 |
| SHA256 | 768d2eb22f580c8b1dfdd8b66925993ce088be85a7df8280170664263b21000a |
| SHA512 | fa6af4ae74906121a8a06a53f1b8166419153e82ef80e30afa9ef9df4de5d6d9f29c35c6ecf02b85943517d66edfe7ba457a56a5fdeb9d8f18dd7208b1da7e91 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 1388e023fe3072674adcb3d5d35e5667 |
| SHA1 | 5f4c0a559d41700f40a7cc4a7214d48231a92e9a |
| SHA256 | 9a356e61d6576da75adaacdc653d5b2d27b28ca06441631258c6012e1bdafb1e |
| SHA512 | 7c4bffc44137963ba8ecfb493f45a01c12d229940c5225f75e53a2bee377e1c3e10061ccc2ecfe5ecbe4385601581d25988da028cb4d3d8f7e03bf75ee282d44 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 27eec39f6e98566e530593762eec95eb |
| SHA1 | 0892492c81a73bf64d23868144c0212d909970d7 |
| SHA256 | 569d645918e3fa1fec0040ce46c00db06fc75739e7ad02d740d7e0160b3ba241 |
| SHA512 | c9f8c53d25596850cd534e30f480f76a188659829caa42826b3799a67af0aa8376bccd995b0b7983a266c3cbdb5934d47e6134e3e37030df662528c1be7b6966 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 0883d9e16188815cb26d8154a9d383f3 |
| SHA1 | c322d30a68513a979b935469d0a9473f0b4eb05e |
| SHA256 | 1a0f6e9c719a59ec2b828372d1c97a8df49e4091ba80a44b6b36b627761959ec |
| SHA512 | 9a6117556ed81fc2ef6221da903585e0277fc184c2c8224ee6159ef29a5680057f395dea5d69db783bc75b3ace711e5edcbff37f6904fcf7f7c7d2cd853ba036 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 5d07d6b02dd7730481968ca92f9d7b74 |
| SHA1 | 3fc1c86ebb599f16efb5c404a7c289fbf87f096b |
| SHA256 | 41d01daff3bf4b38c36a7c61eaeb302b0e0b735df4b9266d97f0d282593d0de9 |
| SHA512 | e22b2d42dc10cbcd96a9a16c1909fb433251d1ffd4a1c73d6cba6583d38ecf7e7e8e3ca89d31bb3b60ee3a2d3ef3be158bb5e6b379511b7ad06f15f1cad220a8 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | f9582fd78495caf46860a858bf4908bf |
| SHA1 | 56040637ff0a3c6a46cd9647fac0336548c40c7e |
| SHA256 | 7f748e617bef9731d587cc1b25770ea80e90ef93db8dc24c41a3fa29680831c1 |
| SHA512 | fc5eb8f09e462bbc1d7079364f29138d9ace90387001434cbc32cbb4d61973862f1a7d6f4a4b485e6c42493c35f9585490f01c1af787508b7c7375fb688c7610 |