Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06/03/2024, 15:07

General

  • Target

    https://tinyurl.com/4jym9n6a

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tinyurl.com/4jym9n6a
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff15f49758,0x7fff15f49768,0x7fff15f49778
      2⤵
        PID:2928
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:2
        2⤵
          PID:2560
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:8
          2⤵
            PID:5068
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:8
            2⤵
              PID:1948
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:1
              2⤵
                PID:2060
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:1
                2⤵
                  PID:3580
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3616 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:1
                  2⤵
                    PID:4392
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4760 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:8
                    2⤵
                      PID:952
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:8
                      2⤵
                        PID:4416
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:8
                        2⤵
                          PID:2428
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3152 --field-trial-handle=1820,i,4714417670711365240,2675429975717422332,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4624
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4896
                        • C:\Windows\system32\AUDIODG.EXE
                          C:\Windows\system32\AUDIODG.EXE 0x1e4
                          1⤵
                            PID:1968

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\61e5019f-deb0-479d-8940-e2c93a80eed5.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  55b39562e708fe5796cf9b41ed086662

                                  SHA1

                                  57b22f68aa54faa2dfae7cc86bf24480978f1712

                                  SHA256

                                  b746ed9843ef1171324c6838511642127e060519b4c29546d37e7eaa0dc1efdd

                                  SHA512

                                  faead73d223b5c538cfc56a5af1d380beb2d7951058b8bbd1aea8a85b1404a12b909cc492a672ac7a302809208633c62e72ff9f6875db7e9fb60d7529ffcc3c8

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  1KB

                                  MD5

                                  6be56255fb53f1fc2760e0b5fbab1955

                                  SHA1

                                  7e566a6bb7d063d7e4ff510c5d217e8b35e227e0

                                  SHA256

                                  ccad380cb9216b7f94169d01b2e6ef32a5147770a3502663e92f991b062cbc9a

                                  SHA512

                                  31b8129280f96de22ab026926e36ada3b558a4745dc44ce0b392b9385bb64e835b684d34325332bb08ca73e1f3bb16e92b16566544855aac8e05ea173c1d4dbb

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  4KB

                                  MD5

                                  e23d2ae3f65e0d1e069cf72b689bdb50

                                  SHA1

                                  c9a200cab7a8c56fafd97cbf1b74c9caab37b497

                                  SHA256

                                  0abed220a16c2f7684ff6140cbd8c24c443bc2e5f639899f5a125b2bc402cb2f

                                  SHA512

                                  ced02adafc4c663b12fc71afcb8e92146c496fd990430bc5e760b8d354f2a51064d0657c4d57e2add1ce3016e7890c7a5bbd520a2a1863ae05025e45edf09f82

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  2KB

                                  MD5

                                  d02c673c9d8b921d44d5c67180d7991e

                                  SHA1

                                  30292366408ae787bc2309949873892d94d74b62

                                  SHA256

                                  f86ee42777b2eb1a2bdae45d668966eef55bf0a084d9b9c39b2ef8890031d32b

                                  SHA512

                                  d1a6cb98cea8723eb2b716ab164f1dce940dcbe5b28f28d6fd61fd1ee5a712c065d98460990874107e9ceffccd5f8079e41993bffccbd7a1a05b1f7415303136

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  2KB

                                  MD5

                                  40f994ad73a00ffdb4a75c29a9d42b08

                                  SHA1

                                  c266adae06f2a80acf916fcb5ba3bc548c2babfe

                                  SHA256

                                  64daa32458045bc9592c5ad729d91484fabbd1662ef79dd5678c8ba40c38bda1

                                  SHA512

                                  814be32f4506ac0ef56f7aea0d42b45119f45ecf626eded5ece66b4655c7c3bb3c708104956e602b207c567dc99ad648d16d4f81e30e615355a23de4e9c42daf

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  2KB

                                  MD5

                                  157223fd9f9e3c77342c2dbcc51e07b5

                                  SHA1

                                  398f8b4d2adde8d164072d8ef23efdfe310826ba

                                  SHA256

                                  eaf69de62c5d5987d83949f2ca2c5f24a70120a1beb6cecb857f541c08f27627

                                  SHA512

                                  268689c59c68227ba1e2ced774406eec104c65d79834d2de6b1ef203abe035f4e378389e8aa34f60d5eee3b821b5236942287b2f89fa611ad1f6810e201ead8d

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  e308cf61619dad517a89a13a8a212d7d

                                  SHA1

                                  60cbb42b473431d491066f236fbefe64c6d997b4

                                  SHA256

                                  577a582cbe2d4293d367b542fe4cd4d8588dc09605b3fa94412f9d7f5e8606d5

                                  SHA512

                                  47121c8f708ecd2f88267f2fa8cbd9d1667856af8768a20667aa811e56dbb73a455e49cc72e1d71ded52394010f4f4efd021737cc942ae303ea330f209ade17e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  4a5ac98735c7fd66bdfb9efb7165d08c

                                  SHA1

                                  5cc7367645daa6c6b3783c41caad7eda816a1a04

                                  SHA256

                                  f42e44f144d7a4ce1ed41b8d898cbb054d8b7e0259420531b4ea9825956adf82

                                  SHA512

                                  8195a24ad27b17e67db1ba68cc53b8998a65eea413497b87c529b7a736c6d215a34b5a82315cd0d9898f3d0a26b7dd07352ce986e1f16aaeeeaa798c3fd3965b

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  130KB

                                  MD5

                                  550abce8af088acf238fb8f77ca367d8

                                  SHA1

                                  3dd089f5860d70488e56ab88b2747499da09adf3

                                  SHA256

                                  2723facf801bef3ce1f69e8160d86d68f7152e404241d7d62256b2e745b35698

                                  SHA512

                                  95834a3c06268049f61143f662d1d155099b6ec87d65b8bdd8d91e65c4c855a8854c33a3b2afa20dd2698ff54df30d7662cffe044f1307e18759cf583b22abb6

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd