Analysis

  • max time kernel
    145s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2024, 02:22

General

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mediscan.org.in/upd/ate/edg/[email protected]
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff62169758,0x7fff62169768,0x7fff62169778
      2⤵
        PID:2812
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:2
        2⤵
          PID:2360
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:8
          2⤵
            PID:652
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:8
            2⤵
              PID:3812
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
              2⤵
                PID:212
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                2⤵
                  PID:2984
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4936 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                  2⤵
                    PID:4900
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:8
                    2⤵
                      PID:1796
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:8
                      2⤵
                        PID:4080
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5656 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                        2⤵
                          PID:5104
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2568 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                          2⤵
                            PID:4988
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5856 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                            2⤵
                              PID:372
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5760 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                              2⤵
                                PID:3780
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2552 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                                2⤵
                                  PID:1832
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4732 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                                  2⤵
                                    PID:5008
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5764 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                                    2⤵
                                      PID:2220
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5688 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                                      2⤵
                                        PID:4448
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5384 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:1
                                        2⤵
                                          PID:2188
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5504 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:8
                                          2⤵
                                            PID:4976
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5176 --field-trial-handle=1904,i,3612693196487628207,12824628520636638503,131072 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3728
                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                          1⤵
                                            PID:4732

                                          Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\962bc643-a6aa-4b35-ad16-1132cc458b00.tmp

                                                  Filesize

                                                  114KB

                                                  MD5

                                                  44a655efb8d5cfd132467de38f489bbf

                                                  SHA1

                                                  250cb6630b4747b33d1a1f57132341d55a656c11

                                                  SHA256

                                                  03df44ded0ab34efb23b53d95b8e846ae323ceaca8cb68ecd6324ac0daad1627

                                                  SHA512

                                                  2f7b52bcd26aa785a1512689b4761606a96468fcce34a386c8239e55a66d78fc4eb7eee316f8d87980524e21780e33259a823ec56613d7a111c032f3c400c12c

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

                                                  Filesize

                                                  198KB

                                                  MD5

                                                  cda68ffa26095220a82ae0a7eaea5f57

                                                  SHA1

                                                  e892d887688790ddd8f0594607b539fc6baa9e40

                                                  SHA256

                                                  f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb

                                                  SHA512

                                                  84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  dcafc52c2286a6d7a30cd056bc3cf63f

                                                  SHA1

                                                  1e4f094471e3e6c3548655a9019f6207f503912e

                                                  SHA256

                                                  978dc5778f6963e26e7063fc7ad242a10e9f8663de951f65d090af1eaff262b7

                                                  SHA512

                                                  d73330d6d5fea658ee84fd09582d4e01f6fea56669a67d88d0dc588e1b9de57d6a1028183ae3b26cbe20738290f786ab0fff7dedf6ca6cb76287417a5aa444d4

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  96B

                                                  MD5

                                                  8ace1fa8d137f7b25798902d7e5362d6

                                                  SHA1

                                                  3f10e14c586330b367c3efe5e212c90f2f414988

                                                  SHA256

                                                  2af9b6a9c09a52d9178effc75e1379bd8338bd14b7c4700e664eea211436fd76

                                                  SHA512

                                                  a14b88f7cc9fe9517a69ce9e5da71c833782afe8722d04cff5128a2d3c41f66a08e634fe18161eb6f187327bd016e9510737a2bcde6092bfe6ac84ee841390c5

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  eba1dfb8dfe61d256bd7bb80116aa8e0

                                                  SHA1

                                                  5a95562a9594d2c2dee5cd0f38da16b8fc2d84d2

                                                  SHA256

                                                  bda5e3cd3e6495159ae8b53dd6a50a9156db89b0ac47c68fef265088e47d4f1b

                                                  SHA512

                                                  b41d2179138864651a46bbac64e571b2d0e585f51789e308988efb3ae927e1d008d11d70d0bcef3c57bff595827d55a1ea581dacd415afc29fc39f76767832a0

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                  Filesize

                                                  873B

                                                  MD5

                                                  fa211ab38ab49673edd5e227666ca35b

                                                  SHA1

                                                  80ddb1d8472b7fbc94b48f4370b3e0703e2b1069

                                                  SHA256

                                                  18d9fd34963422e8ce39f465aed2be67cb529c0641cb9af330177b4b523517a1

                                                  SHA512

                                                  97db2fdbf0ae51343b4df7c60c543337a9f1676b5263cf8ae8345f9451cc6f3c4e710c84a97cb11dde5a0a13f8d2d857772d3550d9165f0cff87064d8cab37f6

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  3881d52696124bd873d2e3f3612ce525

                                                  SHA1

                                                  a21b5e71c047d801583fc1db2525391136c84d07

                                                  SHA256

                                                  6426f59ec971a346a992b609b36082a791381c29119729f7aad5a7bcbe0263a4

                                                  SHA512

                                                  785e1372a0c5b03d8bfc9d33647402ebd3580f3d6009db73d79274e89a6a18e7f9b452ddc534df52f966528b34889f8e3aa33d10913d2dafb04af9f8e7e1fb87

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  d7df6e274532e38ef20f27c3c6a60249

                                                  SHA1

                                                  2c5f80773d7fec3514f406a062917f3a6b7702d9

                                                  SHA256

                                                  00091d1c7c82a4d1f9f6bf66949fbb9a2c4ae137f7a7a9549d399b28ba9c15f7

                                                  SHA512

                                                  49cdd595c252dbfeb892257628a1971f67429c2e62b8d5ebb4dce2f2cc544c0488635f107c3d3107a2afb2e05c236a7e561630f067b0041f69fc2b8d58f013ea

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  d691b603ccf958dd31c1ffc257d77f3f

                                                  SHA1

                                                  5962c3ca18180228126a9ee451001359171461f6

                                                  SHA256

                                                  6057cc45df9b614664f92f539a890e43b3fe30924964174d77da1f32b77eacc3

                                                  SHA512

                                                  c6b8c05fd9be55fb7cb9e298c7579e094071c186650dd1691bcabad07818fafee23b352e8502072079dc4d3eba84a4be66943014603ce3596d372ed9e6f5bd7f

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  32ca1ae4d6b1fb2e179f9cab4b5a7b06

                                                  SHA1

                                                  0a5a9c98ddff66cc6a6948b12bef599a693b5ace

                                                  SHA256

                                                  9577e265b7790b14504cc1cb2fad33871d226d5bae487a12d7547fb6c61ee4ea

                                                  SHA512

                                                  42b2964fa7959eb22336c361f3c4796cc54cf59f94865056fcb7074213f99183ecdcaa5ce57533a6477b08fd4b1da31d5d4e25305b5ad4c5409154077fc510eb

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                  Filesize

                                                  72B

                                                  MD5

                                                  cca112ed12634355db9b22a58dd98dcc

                                                  SHA1

                                                  878dd8a98d97e0a1a9444d0a7c46e7b7162fac1d

                                                  SHA256

                                                  282d27f6be42f89deec9792ab0cb183917b9be1808669c9d5e875188d562050b

                                                  SHA512

                                                  98993eb6e61ec04b08f202c590b5e4780b76ba02c47707fbc16632a089a7aadd48626a5254c286478ac2af1df0dea879c94acead0c6276c3116da66b677dc452

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cf80.TMP

                                                  Filesize

                                                  48B

                                                  MD5

                                                  1a81f5e54ee6742a6c0ca3ed5de45bcc

                                                  SHA1

                                                  577657077706649e7a8fd9eeff1f64493d9ac22b

                                                  SHA256

                                                  aba206c5acffe1bcd284cfcf085b8cfbc48e4d319f22c78ca8fcba1b1ad4d290

                                                  SHA512

                                                  a174f8fcb1de02151a429600c8a27529f7fb30084329528c054b60aff00cec2b9d393af032632d3aef35a8654593eb89e010b690174675d270f4d26ff1004061

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  114KB

                                                  MD5

                                                  02222a3824e2da6567b4279e7617d6e9

                                                  SHA1

                                                  8c7ca78a57916f98adfcec4294387dc9151046ac

                                                  SHA256

                                                  fa316fdde1ac582811011fc17258d743cbc026b976eac75e5c221c8092d1702b

                                                  SHA512

                                                  5b75bfc50e17506ccce7f39fbe632a0b38314ba1d1889ddb332fb97c92fee1a581fffc0f6b19ac155de9bf9bc2aafd55bcf76f78dbfcef6d63833b2e308cf083

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                  Filesize

                                                  2B

                                                  MD5

                                                  99914b932bd37a50b983c5e7c90ae93b

                                                  SHA1

                                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                  SHA256

                                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                  SHA512

                                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd