Analysis

  • max time kernel
    77s
  • max time network
    82s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-03-2024 06:53

General

  • Target

    https://bucolicmason8460.tumblr.com/QRUBpeX

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bucolicmason8460.tumblr.com/QRUBpeX
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe08ae9758,0x7ffe08ae9768,0x7ffe08ae9778
      2⤵
        PID:3148
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:2
        2⤵
          PID:5080
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:8
          2⤵
            PID:4600
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:8
            2⤵
              PID:1248
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:1
              2⤵
                PID:1768
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:1
                2⤵
                  PID:3988
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4616 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:1
                  2⤵
                    PID:3932
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3684 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:1
                    2⤵
                      PID:3488
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:8
                      2⤵
                        PID:4724
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:8
                        2⤵
                          PID:3136
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3948 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:1
                          2⤵
                            PID:5492
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:4852

                          Network

                          MITRE ATT&CK Matrix ATT&CK v13

                          Discovery

                          Query Registry

                          1
                          T1012

                          System Information Discovery

                          1
                          T1082

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                            Filesize

                            216B

                            MD5

                            9de152bd9fb19d4b16957b8080b17499

                            SHA1

                            493caeaa38e10cfd57fbfa2db533bb4a29d8b72d

                            SHA256

                            8d6d804b6c59cef612276c719206cd7098d3bd639796ac8f72c9289e9c52d8f8

                            SHA512

                            f789728debbaf96cab6d24e98bc4ee0fba6d72d89dc046b6d6335a7f4e9e874872509d6a1abf753dc1660f5d5281bdb350220d03bc2480defcfbd9c7daac2450

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                            Filesize

                            408B

                            MD5

                            e94cba48ce24e99dc07152ae1380b2cc

                            SHA1

                            aa8f3813dcfd1ea4c5a118ac8f1c5120e9b2f0bd

                            SHA256

                            7af4ec3136809ef85bcd1167070ba880903b2b6907f50dcb8fbc764eb386f665

                            SHA512

                            f6ae7082354b7afa446f49d718da2517dc24cc59658a04df804f94dbccb9650ad383518c7f221b8e46dca85f95057cc8182ef718d792faa54767dbfbe066c1b6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                            Filesize

                            2KB

                            MD5

                            a737d02ff74f9497e6a330230e4244c1

                            SHA1

                            f91eccf1f6cc0429080204e5a9a3a6e2597ef729

                            SHA256

                            4d0fb2bb30fb9ea31ac616390b103fd3e077c62f6a59add62cf708add560623c

                            SHA512

                            94395d7402ee0699c3266553d3d28027ec95b69b85c3a26f3acff6451be2c1c7c1e0f762cc38bf0584fd4c73492f909d690cf13814be756a7d7fca05ce05b1e1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                            Filesize

                            1KB

                            MD5

                            e64eacaad73cbaf06d27c624000f07d8

                            SHA1

                            4e18537aaf7edb8c98f658fa40568b5b69e9084d

                            SHA256

                            53beca9da8d79adaa37710f9c40e34aa6b14e68879fa376fe45facaa71096e32

                            SHA512

                            567332f02f1dc9ae5396125db657146413fa859a1ffef2efe7845e308b45f6774dbd15fe86e9b9409753da5ec247b0276f5e2bfb78dc7928350d6a912ea82607

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                            Filesize

                            1KB

                            MD5

                            9a1dba7774e4677f87aa59da5c70bb7d

                            SHA1

                            7a7bd7d6ed5ab1d8c5acbf206017c1fa7e73a74d

                            SHA256

                            cd1e70171c95973e18cbe74f2c82dd3dc83a2997eefdc408f1348039a1915bd9

                            SHA512

                            96c05e6a573c4070edb71e491657403a70531d8f76d2b0f9aed4735ae408467cc669ddefa34db0cb5ae97709f47c72ca2559b44b4d355b80124c44bdde8431b3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            7ce8682600d680d75c6a07e149b169e7

                            SHA1

                            a6e1c88c4b164a362ea6d899e2b913cd4ea0153b

                            SHA256

                            9f8ba07540b2ee77536c827edbafa7d42ad034be1bb2f6bf1078fba32bd0e4d5

                            SHA512

                            b7a14694c1d34a4fcad185c52d3f5a880f31a8139b29050e1285354279538a96ecaa634b4b5260501a4aa446fe437d41839ba4187ffb77b887a9e02737273d9e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                            Filesize

                            7KB

                            MD5

                            6f59a4f78749b4c5f5fb38219db58c08

                            SHA1

                            d5902cff61582b2e86774b8b52c020e283f3140e

                            SHA256

                            72f36006c784ed5241f669cce9ec2faa74bd83729ccd6d7ddf9bead09338592c

                            SHA512

                            c3b1032afa32a3df5b20105f1a8ba35fec8c263d9a50be200278f9cf88e1d0714f4ab685dfbbe95e4727da6512f0e1697abee45e7eafae3ea4045af3485b117c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                            Filesize

                            128KB

                            MD5

                            00cf55c42c96b196d3d3d7064dd6c6d8

                            SHA1

                            27139988632eac8416575a768cea9cb37bdf9338

                            SHA256

                            ea0eaa307b3beb0b0b4d7d0bf9bb3ec019a064d74e4198fcf8dfa491e8dd0342

                            SHA512

                            644411d4060908d0b186499809c93194bf7a4564b6e947222a234c4d885bb0da508bddc46f9cc098906c66c4b9474b0332b94bcd495abf23f0c2c469b0b6ba21

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                          • \??\pipe\crashpad_2264_BYHLBXRBXVFMTKLN
                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e