Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 09:36

General

  • Target

    https://maps.app.goo.gl/AznGMMP9FNsaeBk97

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://maps.app.goo.gl/AznGMMP9FNsaeBk97
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda3379758,0x7ffda3379768,0x7ffda3379778
      2⤵
        PID:1880
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1880,i,6369842766331122200,228926119575376938,131072 /prefetch:2
        2⤵
          PID:1028
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1880,i,6369842766331122200,228926119575376938,131072 /prefetch:8
          2⤵
            PID:3120
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1880,i,6369842766331122200,228926119575376938,131072 /prefetch:8
            2⤵
              PID:4252
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1880,i,6369842766331122200,228926119575376938,131072 /prefetch:1
              2⤵
                PID:2068
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1880,i,6369842766331122200,228926119575376938,131072 /prefetch:1
                2⤵
                  PID:4904
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4640 --field-trial-handle=1880,i,6369842766331122200,228926119575376938,131072 /prefetch:1
                  2⤵
                    PID:3868
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1880,i,6369842766331122200,228926119575376938,131072 /prefetch:8
                    2⤵
                      PID:1172
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1880,i,6369842766331122200,228926119575376938,131072 /prefetch:8
                      2⤵
                        PID:468
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=820 --field-trial-handle=1880,i,6369842766331122200,228926119575376938,131072 /prefetch:1
                        2⤵
                          PID:1736
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2380 --field-trial-handle=1880,i,6369842766331122200,228926119575376938,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4432
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4816

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          504B

                          MD5

                          9fe59cd4ee7a062094eed32ed4db403e

                          SHA1

                          aadce95abdde78fc68c368a7088e86f1028bffc9

                          SHA256

                          e5ade709fa0fd898da31aa449e3cd0038c3afb0e188064a1695f8922b05578e3

                          SHA512

                          084b32b41d49834960bb27bdd92faef3bb5ce1fae197e1e1adef7f2772abae02c7c3fde0b4b9e3efbf04e5ff7d7d45d248752aee03dcfb8818c170fd248fa534

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          216B

                          MD5

                          3e019a55ff03c35b785ec93954282e7a

                          SHA1

                          a54843d48115d87c67103d8447eeeb52b35161d2

                          SHA256

                          aeb2fab1447172fc9dc75d9c1f10ea87c912902b7f29bc6f3f46120413689aa4

                          SHA512

                          4d2c446a1331db594d9c4d21f0490cb679f17e8c7150b344810769c0a92c866068db81b49664a1605b35e81d9ba23237e3e3559c78fdac6564b16830fe79141b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          4KB

                          MD5

                          5c655f73280e8913b8767a2646de7585

                          SHA1

                          bf6c42936658a76a405d477da1cc19e68d99003c

                          SHA256

                          a091cbf55b8f2d4a539ad4bbe6e3d7b12647949a8d2cccfa506ff97eb97e59da

                          SHA512

                          99a1ce732324f9a457355805a58631ccf99a21d01f2c1e278b9ea88cc1640e1aae1f62417a51519d3e5a47c5472e0545e6062848784d42d68ded2028703dd6eb

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          3KB

                          MD5

                          03ad5786cf1146f0e3324b193e849510

                          SHA1

                          7f7760a11821d7ccd6c4cce0f681131ca48e72f2

                          SHA256

                          dbe68922e001e59b83d1cca532d9b36a6abd0dd4a9628ef76eb554578d3a07cf

                          SHA512

                          fa3f5c6d1f19e725b49bb108a60dfafa47b089ee4a432bb9bcec82c2a07947c51ec71d2c7e961612c431eb2eba66ffbc7789ac2b2ef80c626a0f03bcfcf016ea

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          5aea5e73e5bf5c71f4aceb8a32b86e70

                          SHA1

                          65453fff4bf2a1936fb092c33c54f362a9185cb2

                          SHA256

                          4015682d2083f771fa1c1c222a7e7f708037852607ddeab3744587bf8da0741f

                          SHA512

                          84676056ad08d3852c092da739f14c8e3dd4786b5c01587052bea8506dcce15078e4b6a20875fd0ed3dd5c42db7cd46b422f08876a0fa0cbf22c685c9fb7426c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          98802e56b5f31335b9b449130f6cff55

                          SHA1

                          a0e81b8b2aaa40fe5e05cda485ee216d41565fd5

                          SHA256

                          f07c5b8b14cf4818d8581f5145337755b21df190c03272a4a9fd4668e872544a

                          SHA512

                          6d3bc8e41912372f7e4ca104d1ca7e8c6c8a0157c4d6ad7c1ac2dbcb4eb2e99304c7ba8c36a59f1b927b7ec65886e06437ee6fdcb5aaa7be0a5fc41a8d7f139c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          95f934eae65f26cdc210ce9529825ce1

                          SHA1

                          29491aede363fd69c919943c5dd60a9943cdbcd7

                          SHA256

                          c47a7d448ed835b961f9a1ca1c7b25cdc48990f947e4a8522a07a62c0074a209

                          SHA512

                          5594bbe43cdcf155972069d34b344f09217df7e52a39c3cadfee5bca2beb4588f852d699b4581cd1c186cb1e0dfbde08826e69f871d9a23ad2db334209f1f5c7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\26399679-94c3-440f-a6b0-46cfd019e8f2\index-dir\the-real-index

                          Filesize

                          72B

                          MD5

                          628567abbdee312c64b7aec160ca514a

                          SHA1

                          1942c615dff9678d1b5c2c4b6e4d4e4cc6c15a6c

                          SHA256

                          b5732da5989d114dde50968a59d30cf22163880f6bf6be7cf4a5fb679cb9684b

                          SHA512

                          ef775d81b23747596bc0196da2dc03647b4660cfcc848392cbfa98554cd9012b68a5141f9e9e74f90059886106cd811fa8d2413ce264219c7aa913b5648c6c5a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\26399679-94c3-440f-a6b0-46cfd019e8f2\index-dir\the-real-index~RFe5827d6.TMP

                          Filesize

                          48B

                          MD5

                          1a031f9c05f3fbcb32646a25a7dc5192

                          SHA1

                          13c85f58ffd815c639d81906d0c5f3a3e056bb1a

                          SHA256

                          70c293ba040936b89f188441f081474334f54a2f7b19c59441fee603a6407957

                          SHA512

                          c0cf7a4b3546e998596a7c5e52edc434cc330a3cc38ac8f4446b9c6575cb1f8e0ffc073bcbf675f3cfc11a0fd3085aac1e3fb9c3ddd98f43b65499bd7f175c4c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\index.txt

                          Filesize

                          113B

                          MD5

                          47dd6c0238789f0186681d11e532981b

                          SHA1

                          0bc011fbac941153cd7c6cb518ae3c40da4e3a1c

                          SHA256

                          701664577990b365cd5ca6a65b255bfb81f2fe2fb35cb7c296fc14ae4deb47f5

                          SHA512

                          97611b4e8cac0495a628965cc65a715b51833d53e55f667bfb3bca4db9ec33b6a6b3379e15ead4705a00267d354cdf21e9c6a67002d233eb54af06ed97380087

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\index.txt~RFe582805.TMP

                          Filesize

                          119B

                          MD5

                          dac1d6ea16eaab8fc5548a9d414d8ede

                          SHA1

                          d1c183b53c794d8b0d59203432a9e84e923ad538

                          SHA256

                          3349d1ed42417df6971bffb2676773ea9220777541388370d97a1468785bad2c

                          SHA512

                          dadd5d75ad66c397d835697489dfd28a3b293874e233fcff7fd68730b11d21b97d60cb1effd762069e95b1d7f98a9ef2c8c5584c4ac9b25f766987dd9d174d36

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                          Filesize

                          96B

                          MD5

                          3d401f117ab3d6018644bb783b7f6373

                          SHA1

                          e9e5a78267360bc85269e49345cde308834bd57f

                          SHA256

                          022abe2da86c9c33312ed9786bb16c4d9800631ecbd192f142c9a0eec75e923b

                          SHA512

                          04ea06d77f4d3d46c1f85755c4fa271daf35c84c6e294d82cd0b5a868e4b9ffec9ef8b0f5eeae400bf1cc83e5c1a5c32a9594e53bf924008fcb738e35756923f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582788.TMP

                          Filesize

                          48B

                          MD5

                          903ab87042439aeba1095b1d0dd7625f

                          SHA1

                          6111e43260e564c772c1daf4597e862d289f7a6f

                          SHA256

                          255fc71a257c21f9d0f67f3d347fd2e3e1baed4c0dde6a60ca8c139bff89538d

                          SHA512

                          773e8e5d5494c90f1db41398b01916e773c902258fd891f54586896858422cb2c874e219052cff2ad2eed34ddd749b0ff3a79fabb80913aa4d8ea58779777414

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          128KB

                          MD5

                          723a9baca8e413f66faa17a672dacd7e

                          SHA1

                          e2b253ee41daff862cabe4232c63326eae28be06

                          SHA256

                          c3275b2e8c0c55ed65c5f3eec0027229a8a8c35eac3643038b83269b20f7ceac

                          SHA512

                          77508543834bba91c63a5401fb3607480c2e62e0ef1340b5424b54639366445f59b15d1c1e3d8f4767fdc5e725b48a4eab7f576d7dc7aadb9db66856462bb214

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd