Analysis

  • max time kernel
    1800s
  • max time network
    1685s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 16:17

General

  • Target

    http://deviantart.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://deviantart.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:208
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffbc96d9758,0x7ffbc96d9768,0x7ffbc96d9778
      2⤵
        PID:4264
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1872 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:8
        2⤵
          PID:2144
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:2
          2⤵
            PID:312
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:8
            2⤵
              PID:4456
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:1
              2⤵
                PID:3608
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:1
                2⤵
                  PID:672
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4728 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:1
                  2⤵
                    PID:1796
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4852 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:1
                    2⤵
                      PID:4180
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3872 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:1
                      2⤵
                        PID:2928
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:8
                        2⤵
                          PID:4092
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:8
                          2⤵
                            PID:820
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=6120 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:1
                            2⤵
                              PID:4780
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:8
                              2⤵
                                PID:4348
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4664 --field-trial-handle=1936,i,10859854420497576828,1337437841157245660,131072 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:544
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:3100

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030

                                Filesize

                                195KB

                                MD5

                                873734b55d4c7d35a177c8318b0caec7

                                SHA1

                                469b913b09ea5b55e60098c95120cc9b935ddb28

                                SHA256

                                4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

                                SHA512

                                24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                432B

                                MD5

                                cf7e39682574f596abdf85dad61625ac

                                SHA1

                                5cfa8ff8f66b07ccd5a07a884d204cdeffd41ad3

                                SHA256

                                31482a4d61454bf2d4719dcbb2f913e0e6dddf69b99db7ff6bdb3efb127cbf7a

                                SHA512

                                75a448d22157df6ac4c49663a31cd919717e697cf8deeb0732b3a34f977a4860b6b3a45f0aaa96cb4b81df2966472fd449ec92c3a7d10da97347d90066a4a6a6

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                432B

                                MD5

                                1bbc0ac7c042cdb232b568cbe09184ef

                                SHA1

                                b02d8fdc6d032cae7f245cee1e1c5db6a0c89e79

                                SHA256

                                bf1d0d74b63dd24dc63e5f9dd44a8c8d28819a8998fafb5bb99b4c8bafdfc526

                                SHA512

                                6edf76878c8d9eee5029d010ed830b0eb94947411d0f26765ab24efb641c12191d0696884673c0256901f620ba2225708a1f03558f84df3173018bf4b5f0d100

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                432B

                                MD5

                                a984224d8289c413675ee64f31a0a9c0

                                SHA1

                                971d68a0218dc0bd776817802dacf8a6a138c013

                                SHA256

                                614873010940c75738e16136924f25460c08dfe053463fcb2774b75a9e0d2ffe

                                SHA512

                                27d31a4c5a82c04ef3165cdc47e472ae0390326440f8777dd7b458e12593996f963d28e3a6982869a88bb781699ed91b27d39af5ec2b63f9bcf9484e2d97d09f

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                432B

                                MD5

                                02a5a81efc78ff6400d6c3cde8af12c2

                                SHA1

                                a5473ca4665660efc9a5ba7437353ff5d10e7fed

                                SHA256

                                ecbba2ed554823636958644f2b61bada74a4243201619df80ff63e45e124a6a4

                                SHA512

                                7ee95da9f0a1442ed9dfcc3e8f2c9d4e9500bf721461a7c5cf7dc45bb18e4c002ae246db027a7d6296119726968e344fcfa083fc0a6e7fad6fe9d392ecd6128b

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                2KB

                                MD5

                                e9e198c35b2d5c6b9fb1e757ae149989

                                SHA1

                                987971ffb5fcdd2d108fd539151b684c4a2ac1e2

                                SHA256

                                b122c8221d0fc5d63ac58ba2822c3df269fb35935eaa9bf7c430ee68658845c6

                                SHA512

                                600e7e508f976ea0c5c958c9f4161471bf799fad3c7a9f21497f42bc94626c926cc8f2d32386ef050ec735db447b8a93aa652d7bbe8627d41dafba902bde9076

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                3KB

                                MD5

                                99d9436b26e7a05296d3199b47ebc471

                                SHA1

                                0f5fe19800ca86d76ff23566ef77794279e0c0b3

                                SHA256

                                b6358b0e879dfeb4d046a22b97d5b3b1e93ba92c086ad6612e9fd9fefe4873eb

                                SHA512

                                5bdbd50ba578895b4f7b5eaeab600a4612afdade8bca4edf682f875b3197cc2022e312dc4d5fb2aa7fb358f06ca3fe2c3fc17902cabb834fd91ce35473dc1be9

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                3KB

                                MD5

                                e9d0e3eb93454c0b6c987b0216d0f40c

                                SHA1

                                7d2782411ac8e80abe87d730e8e0cd1c635d9a9c

                                SHA256

                                ffe15ac36e1ba6b3ee5563acebd48699e9f21c8da1774765e260d8f2e01200df

                                SHA512

                                bc6cc88c61d9ab5755ae8b9fecdbb2d5a7c65ea4d7cb63f77a113895b095968cd4fee57502e96f8a16a28f4066c1faed128ee9727e4832b325d1cec29b497626

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                2KB

                                MD5

                                e00fa4a60139155dc708d178ec080f69

                                SHA1

                                bcb9bc1b55ba37aa135ad3cb8fb723e605a21156

                                SHA256

                                7702c05aab6512c79fac321acba5b342eeb1e00d6f8db5e4ecd97909d456fc1f

                                SHA512

                                c4caf7f5f53986a16c6199c73b263c67ed8f0f4ae0625745f988ae61a58a96e26372c64789b852114a27eb566ef67c551ec4c24384a4bda79d43dfb6f92682e4

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                3KB

                                MD5

                                ca580f5637f8c71447158bfd5573937f

                                SHA1

                                441a0be0631ceae96d3b57882b0d0b23cc2db629

                                SHA256

                                5c1fef6613d31911f696e5da3bdbb0b16c68480ab680141bf0e05a65844bdb2b

                                SHA512

                                279e8a3440485317cb3b884bdb8dc045f71c51f4b60bc2b822eeb4b6273ceede645f5ee65cd184a0a3e01cad58c413e028d24be8113c92f6db7f21e999505e52

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                705B

                                MD5

                                4976de43a880d2847d6be879930220b1

                                SHA1

                                78a727e6216d91e7e8d8a7fc8f7185cd6ae9723b

                                SHA256

                                d7460e043bd5d59d90300bb60b14bd2826ece2f93585e1fb2f133f6808166765

                                SHA512

                                172bd3c71355917ca0ed6c0733a3fe56d03aa6cad272b01e92613fcf34061bd71094fca411e04b075329408aee017a5fcb5c4075438d3b0ebb1a2f26a33ed111

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                fb79dcf36557f3e38138181fc087dd53

                                SHA1

                                e9ba899a056bcebab426ae526dee9f3333215bfa

                                SHA256

                                7498ec435d74168d39bea69a695cd69e7993f15ef6e3453a7d3d2182affdc3a2

                                SHA512

                                4c240c450978e1b32c038d71ee074e30ab48452474aa5cf7566a7f6882ccc1368c5dd32138de47aac2ddd91deb6398248d1ad45efb2f06a5db540b852edb6b5b

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                7KB

                                MD5

                                625399d532d2e21ef9b8a7aceaba5bbd

                                SHA1

                                15d661375f2b3812aa37f6c89e410fc07c58bb8d

                                SHA256

                                d47a49d8d13dc191180c9d659b5bad9c6f20aefccef8da1e1c1c31bea66e05fa

                                SHA512

                                2b380f4954b5e604ae5041ed895082a6692435e774681984fe79180c640670ea23dd51451bd04d5549ae4e08b3e38bffcfaaebf866f54c82573475b62841c813

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                130KB

                                MD5

                                7367c4e379677facd76fe2502600c951

                                SHA1

                                6c93818c668180bc799eddaea08283746bfb678e

                                SHA256

                                b9f7675807bac9143a0bebfd1050e9f3b2e228dd835068786d8b98b29d7244e4

                                SHA512

                                415efebc8acee70e2484f05a5de2588db75fc27d9d0d57f3fdf726167622d0bef7639f0c2837cdd3ff3399cda7a1c8cabacc33f9130a52d6f849ed82fa6aa65e

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                130KB

                                MD5

                                61e322219b1218cd3f5c2922a93dc8f1

                                SHA1

                                7f5fcb9b4814516b669bccb78842ec064ba0df27

                                SHA256

                                d486c2beb8c99314b3d09713e10ad39e2e3d9af2f2254631808dcdbe20216022

                                SHA512

                                6412009d014185c5f02b64332f3b663eeb704e0d5b4521835e8d3f1a7cae5d8e61945d17133edbb24b33529074c271e47043e31e7cc29f61ddd10e46f5a16b77

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd