Resubmissions

14-03-2024 22:37

240314-2js8asbc83 7

14-03-2024 22:36

240314-2jbcgsbc68 3

14-03-2024 22:34

240314-2g4agshc6v 7

14-03-2024 22:29

240314-2ejs3abb53 3

14-03-2024 22:22

240314-2aenjsba29 7

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-de
  • resource tags

    arch:x64arch:x86image:win10-20240214-delocale:de-deos:windows10-1703-x64systemwindows
  • submitted
    14-03-2024 22:37

General

  • Target

    sscserviceutilitiy_4.30.zip

  • Size

    936KB

  • MD5

    37bb9a60ca4c12ccfebc3525d3471ebe

  • SHA1

    893d65250d8304ed0ef86f1f1a16491ee7db4459

  • SHA256

    8fc3b1fa5ecb087e05099a67e7b39a8b452830b2e36c50a1c2c5f179c74e5402

  • SHA512

    d853ef9e5447c337cab104f3eabd0dbdf71dd70fc94e9e28f97bf6bf14dc1b63878642a831d34764c00df95c2525ebd442ad946142ffba936269f352e3cf9f0d

  • SSDEEP

    12288:aEKU/P6S1pHJYWVJixGmTzK0f5lRY68AD75+Vm0UFAXVN8qh7KKncarSFDkV:rHt1lJYQyKAxwVmu3npeFk

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\sscserviceutilitiy_4.30.zip
    1⤵
      PID:5064
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc2ddc9758,0x7ffc2ddc9768,0x7ffc2ddc9778
        2⤵
          PID:1436
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:2
          2⤵
            PID:2996
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:8
            2⤵
              PID:1300
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:8
              2⤵
                PID:1484
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:1
                2⤵
                  PID:644
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:1
                  2⤵
                    PID:2132
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3904 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:1
                    2⤵
                      PID:4432
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:8
                      2⤵
                        PID:3972
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:8
                        2⤵
                          PID:2152
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:8
                          2⤵
                            PID:2388
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4164
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:648

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1017B

                            MD5

                            9e46600c5c76174cc200501c162abce5

                            SHA1

                            08c8a81781e34b8a7fe060a6ed9097a11fd77ec6

                            SHA256

                            990f7bdc3c680cea1c1d5c38679c243d14c0e2a0cca9e2eb72270e89bef48ecb

                            SHA512

                            c3e34ed24b830803d21d818090308288681edec02479a354b40733febf3ae4b7906addc428975f9fa30e95cc846490ed6a36bb2627a6b739c3a2f5fac25a3b86

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            369B

                            MD5

                            fe1e1bef076c92303a6dec09f10b98c2

                            SHA1

                            5973c4ca7dc99e128271d25407c3c943a417bb5c

                            SHA256

                            9c732428943e3df804ab540df51a96b32da846af683696bad1fe1bc375a9a436

                            SHA512

                            279eabb516b2a01eebd8e5cee37f7a23b2066929379742722c755fd1535224937f511c8b20602c757b7d4718b77749eae57b6954be64c8d4bca7b1ef97a1dad9

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            f355279572cd0e2807c9632ccde0cca5

                            SHA1

                            ad877e3959b53a64f6cc9c1e9d4db1c81f6082ab

                            SHA256

                            5294450bd51adc4b41750f474e4aa2933f6a830b6bc6b5e6f4e3b4cca0f5556d

                            SHA512

                            fafd23c0217dfa5f8cd391138c3075d320bdd8b18a67a90d03eb53e585060bfe938415bd73828a33d1ca4e10d967bb56e44a3fd439f1002d046b6a2e5f2b8efc

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            6a24b9c69f228f7ec8332d129bd09bd3

                            SHA1

                            f9a79a626e8d4e45e4ea38ac8ed3c940c1370605

                            SHA256

                            ff61d48ee0b323e3bf07e2bc5b8e08a41e1c1eff6f15484308149f147f79460b

                            SHA512

                            501cdab170cc651514fd90b3670fe87fc8344a9699c47f5f6aad2d9dd3e018d87265f7c38bdcd2ad72466115b974377885725587bbf8bd74e9f216ad178b87bc

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            0ffe0ff6eb39bc17a257a2fcbe456745

                            SHA1

                            e0705a66096ca729d955e9c292903404e51b4814

                            SHA256

                            3aead86a857b3bb9d50316a23afc28766fd0ed43ce4a5495e567ead14d415a56

                            SHA512

                            d0c221d31770cfac2b21b6f1e98ecbf22f3e3640c648c7c5c612646c9ffe14a8661082c6abb30187e6b89e002aa586d9e1240bf0f8761606307ec4db8caf98d3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                            Filesize

                            12KB

                            MD5

                            3eef37f0a2aa5e83074fb830c423ef9e

                            SHA1

                            fc5631e0e022e338728f91568507e127171f6707

                            SHA256

                            0cd1765c66c89259813d93205feabd1ec4c0297caacb3980b2e4dc55a30aa57a

                            SHA512

                            3d978f4841997f368c14e422ef9c6d1c7ba005091725e725e2b8d5ae13f249318ba105c26f65a0fb95f84f4396ce2e04494f8ea96115d3b7a155892d4cb318d0

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            258KB

                            MD5

                            4aa316d3778fc334b54a9272a4103543

                            SHA1

                            976fb915b36e2dd7cb4c26126d24f005ae7414bd

                            SHA256

                            58036e13d499af717b9f22facea18933cd5aafec904b5909275a5aa9f77db4e5

                            SHA512

                            840089d95d3196ad3379df3210a161a317d24d1c2a4fdead60bbefe01beedcc93c1312b286fcef6d08009fec8bce99f611bee17dbeb9c5245e7f862fcbb2065d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd