Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-03-2024 22:08

General

  • Target

    http://sexyleakd.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sexyleakd.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7fffd70f9758,0x7fffd70f9768,0x7fffd70f9778
      2⤵
        PID:4492
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:2
        2⤵
          PID:4652
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:8
          2⤵
            PID:4708
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:8
            2⤵
              PID:1052
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:1
              2⤵
                PID:2708
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:1
                2⤵
                  PID:440
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4640 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:1
                  2⤵
                    PID:928
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:8
                    2⤵
                      PID:2092
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:8
                      2⤵
                        PID:5216
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4008 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:1
                        2⤵
                          PID:5592
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4752 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:1
                          2⤵
                            PID:5720
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4724 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:1
                            2⤵
                              PID:5856
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5520 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:1
                              2⤵
                                PID:6080
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5296 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:1
                                2⤵
                                  PID:4112
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3804 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:1
                                  2⤵
                                    PID:5960
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4884 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:8
                                    2⤵
                                      PID:4620
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:8
                                      2⤵
                                      • Modifies registry class
                                      PID:932
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4960 --field-trial-handle=1872,i,8255878208341694730,7367691258102749650,131072 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2940
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:1112
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3716 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
                                      1⤵
                                        PID:556

                                      Network

                                      MITRE ATT&CK Matrix ATT&CK v13

                                      Discovery

                                      Query Registry

                                      1
                                      T1012

                                      System Information Discovery

                                      1
                                      T1082

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
                                        Filesize

                                        27KB

                                        MD5

                                        93e7c16239dbaa1d7ce242fe773a0950

                                        SHA1

                                        69f8f623b98f7271246e5104e5b0be96666be9cc

                                        SHA256

                                        4c08b630669724d71e5946faa29c85e9f62ca9e5aad1cb9625ffe27fb0f14d32

                                        SHA512

                                        bf660c22bcd64eeb197953ef2a43e31bcf73564e2cf854384bdc1b050a9804581b7cbfbaa8fa24afe3f5621cc43ad72c2c88d9d9dfabf302aa8290c5dbf40c88

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                        Filesize

                                        144B

                                        MD5

                                        d795ebdb3015ff5da375d879b8aafeb2

                                        SHA1

                                        963686c30fc364fce1ec432ca2eb54fab46f4e4b

                                        SHA256

                                        8bd046c932c55e9f4527fdc3625acfbc8957d3eb1fba1c09a8046e30bf19af06

                                        SHA512

                                        dfddec5d5a73d3b76be07849efcc4f3e998098a613ab825e727d342c477cde667c787eb84b168a26d0fe19b463c8a228e19e19d85967958a24d492f9bdb5ba37

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                        Filesize

                                        840B

                                        MD5

                                        103821b78c0cdda170a6f5de65d73669

                                        SHA1

                                        06046f48152c550dab56722553b8b912a8b380f7

                                        SHA256

                                        ded00907ac19a1e4c2387e735d855f70213b2e65088878ac454e1bf294307424

                                        SHA512

                                        c66ced2420d19dfdd44296434a56d68fdd212b196726e5b891e35a70601e375f2fa291d458138d441c90fc128d095879f9df0d2ae82938adf959f151143ee7c2

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                        Filesize

                                        986B

                                        MD5

                                        98bd1c28fbcd4bbeafc49d6bbeed367e

                                        SHA1

                                        8d541b9d446ca0db871511b2cef129455f2b3ec4

                                        SHA256

                                        fd69cc2eb4d170ff1613b61ce452c1fe25852a5fb856d46ca1faf1411bb1e4f7

                                        SHA512

                                        1ca7f0bf8ae3e563bcf908ef06290077d9e5d529b04866453ba5233e35a8776ee8c1d0e27455514692f300045f7c0175101c1ae7727342062cf651bcf3806a45

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                        Filesize

                                        4KB

                                        MD5

                                        5a399d25b43dabff90a66f57704282c9

                                        SHA1

                                        ae27446bc5f207e03c05daf6154da0be6b6cb66d

                                        SHA256

                                        0dc2eba81370cec30ec24b120ce513fc74955e60bf0deb141f9cc24a3ed14151

                                        SHA512

                                        7078202c31602df50b9000850e9520f369489db6708b7cd4bbfc80f008e8480f64b72fff9ed38bb07ff3b2d63692a963b4cf5a70a8ac4c3ce2cfb701a9ce96ee

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                        Filesize

                                        702B

                                        MD5

                                        076a2d5ca739ba09a99c0c7af8cf3022

                                        SHA1

                                        7bc6ed54c19877258c1e97af827185b92199f904

                                        SHA256

                                        1da16380086ba9df64b381932c9551f9ef9468838fa6c885fd093c9ec6da7440

                                        SHA512

                                        f2c992fdc0a3379ceae7f7c4b1823cac0ee65b4903582015281e2f3241b672b6bd60e6adb4c751ede1eb0f81eea80e09139860218e85fd2d4743c3e450ee2088

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                        Filesize

                                        704B

                                        MD5

                                        ac88ebc4abc35d4e866aeba36973ed92

                                        SHA1

                                        dc6da2a681a190fbc2f5193f606b202e0bd16d1a

                                        SHA256

                                        c57fcfc1d397f1288655f62def07263bd87bbd147f98070854a64f62c5c417c4

                                        SHA512

                                        5c4acb0f6c0028a8f58c9c1bf23f280263596a785c75ae58469a24504cb676b7e415a03768f1867b092c1478f1b396e661fa2e680fb8488271baf08afed641f7

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                        Filesize

                                        1KB

                                        MD5

                                        e900cd8d1d44c2f62b25ed53e7d388e8

                                        SHA1

                                        7054b1232731d1cb7667d776bacc43a6f18c56bd

                                        SHA256

                                        3f65edad05e00806d576c0d00b9e71d50b7aa04c6a7a6e65feb0b36e71ca16f2

                                        SHA512

                                        3e5cb1943935316128abae3cda9fd7cb80b7862d2bc77981b133cdc840d07253e6ea3c96b5190e47a77a14b8fcb7ba6995b941e944dd84f202164fbf6554246d

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                        Filesize

                                        5KB

                                        MD5

                                        656ff48efe95d327ce7013e64988288c

                                        SHA1

                                        7ca7e10e802f8ea3334157921d6fee62867bc984

                                        SHA256

                                        cadf47091c16702b2104f22189cde808816c2992f72760de003e730cfe4fd615

                                        SHA512

                                        658ae280ab7eb67c369d283e71b6f3fc2c01144d6c008fc87b9a73f5cc2c0016d4a1891eda1e967115bef69e3276fca2afc2d14cd507d1abfb23a737677c89a0

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                        Filesize

                                        6KB

                                        MD5

                                        3e1ad97e61a6e0e17a27cffc5e1009dd

                                        SHA1

                                        f5f186f4bd6f0afb46709a69d69e0a799c0f3bb6

                                        SHA256

                                        a25e5c54dc813919e428aabb37228761dde4f3b63c7bf17b5ad582af6a08bccd

                                        SHA512

                                        a85673ae2137d477534a60fa1c557ca590036bdd1129661ea84d174e1267d149bbe8b439d0777729e92c335bfecee6ee190d821d80a9118afba5964073e1b190

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                        Filesize

                                        5KB

                                        MD5

                                        9f10969f9f70c237b646a6d7c6240010

                                        SHA1

                                        e6099a39add5d7a695c48b4a1ca1f1f81e13e1c7

                                        SHA256

                                        771d950e7639d689f95cf6029919230843b499be1ccdb73846a8f09b433d2cdb

                                        SHA512

                                        28fb6b329bbb3fcebf2d3985928e42f1d53b45786b26d9489be1c627d4d51988f02872844817a923a47a5c6ad8e837fee2f62783e892bdbeda387cb657487d15

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                        Filesize

                                        128KB

                                        MD5

                                        9194dfed7b95f8b00a69ec95f97d0e5e

                                        SHA1

                                        04015557060bae937f23752cdf5c8fb32b39baa6

                                        SHA256

                                        ef2b5d302e9c209b224b8b75b92a19715b50a4fa71efb4ad22b1899d1f2b81e9

                                        SHA512

                                        c04ca98a3dc62c6fcdff826ab7a1b694c480368969ab515eb40eabbf486864340c3d8ac6ba18bb50adcf3f7584a8325daf2dc0e5f3dc707d54de75f499fa0fbd

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                        Filesize

                                        128KB

                                        MD5

                                        0f00f53f211fbbb01c5c2c74a45223ad

                                        SHA1

                                        40997dc6873566cd36072c1de915982a097e932d

                                        SHA256

                                        b54b92f4d38e0066c79b82c3dc5ea6dd5226ec41351a2b92c861a9cf5f782852

                                        SHA512

                                        4d9fb94cbaa1de26448bbf58dd8b1f35c4c44fd64a2f75d320bbce966c57942a1dedfb7c35f9fe0632dbe7a9f18f7836d08c207acd33b8a94aefad50daf4d33f

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                                        Filesize

                                        2B

                                        MD5

                                        99914b932bd37a50b983c5e7c90ae93b

                                        SHA1

                                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                        SHA256

                                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                        SHA512

                                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                      • \??\pipe\crashpad_4964_OOADETPHDREFLWMA
                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e