Resubmissions

12/04/2024, 16:53

240412-vdzdsscb741

12/04/2024, 07:35

240412-jew5aagg671

12/04/2024, 07:35

240412-jeqx9sgg65

12/04/2024, 07:35

240412-jep1zagg63

12/04/2024, 07:35

240412-jem7dagg62

12/04/2024, 07:34

240412-jelnjsgg59

12/04/2024, 07:34

240412-jejtysbh2x

12/04/2024, 06:10

240412-gw843abd5x10

11/04/2024, 18:54

240411-xkdf1saa3610

11/04/2024, 17:07

240411-vm58psga378

Analysis

  • max time kernel
    2699s
  • max time network
    2644s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/04/2024, 16:53

General

  • Target
    https://github.com
  • Sample240412-vdzdsscb74
Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff96dbbab58,0x7ff96dbbab68,0x7ff96dbbab78
      2⤵
        PID:1492
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:2
        2⤵
          PID:2376
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:8
          2⤵
            PID:5008
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2176 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:8
            2⤵
              PID:3060
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:1
              2⤵
                PID:4480
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:1
                2⤵
                  PID:1836
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4460 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:8
                  2⤵
                    PID:4692
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:8
                    2⤵
                      PID:856
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:8
                      2⤵
                        PID:2344
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4784 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:1
                        2⤵
                          PID:5072
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4000 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:1
                          2⤵
                            PID:4848
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3180 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:1
                            2⤵
                              PID:3716
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2728 --field-trial-handle=1644,i,16674962628803517605,1907435581143980318,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1852
                          • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                            1⤵
                              PID:2436

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  f_000006

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
                                  • Size 24KB
                                  • SHA256 9b9a4a9191b023df1aa66258eb19fc64ae5356cfc97a9dda258c6cc8ba1059ac
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_000007

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
                                  • Size 44KB
                                  • SHA256 3a44f7be6fcf889e508b789374c0fe29344dc6fa7a25348083888f7c98f0c57a
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_000008

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
                                  • Size 49KB
                                  • SHA256 78f0f79cdd0e79a9fba9b367697255425b78da4364dc522bc59a3ce65fe95a6c
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_00000a

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
                                  • Size 21KB
                                  • SHA256 14d0a9ba41b036d7702963b2f0048a670f138372fbc3644ec4f009cd3184e041
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_00000b

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
                                  • Size 20KB
                                  • SHA256 befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_00000c

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
                                  • Size 64KB
                                  • SHA256 ab07d96b1a26c5ac9b3b50926ad7b383750ad38c8b32fae109f80e2c988c7ffc
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_00000d

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
                                  • Size 59KB
                                  • SHA256 8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_00000f

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
                                  • Size 151KB
                                  • SHA256 bf252b560c9cc78dfa63abe0ae5caa03b83e99b1ca5fae3c9515483c57aaae3f
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_000014

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
                                  • Size 22KB
                                  • SHA256 054535a07f5276662f52646fa7dd4f2cd98a2e5d893af15e7a4a248f2fb80dc7
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_000019

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
                                  • Size 20KB
                                  • SHA256 8e615cfdc796b0bd3a273fe88aba558104f2bc0604b1bba0747734d33499c223
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_00001a

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
                                  • Size 20KB
                                  • SHA256 4f045ad54b1ceb12dff94dcde022c0660d6e41f9cfd0b0d80d4ad57a46cbc377
                                  • MD5 SHA1 SHA512 SSDEEP

                                  f_00001e

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
                                  • Size 80KB
                                  • SHA256 7c187a978a3dc78015c938dd3308a02b00ab91f0b78e28c1e70a572df8f5cf56
                                  • MD5 SHA1 SHA512 SSDEEP

                                  6ae52cf7c0166b75_0

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\6ae52cf7c0166b75_0
                                  • Size 1KB
                                  • SHA256 e800616e4f767192c1a9f858ec20be8328d9957c4b8f69cc5ded3c77b61a2762
                                  • MD5 SHA1 SHA512

                                  bc9e1fd4409420f7_0

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\bc9e1fd4409420f7_0
                                  • Size 7KB
                                  • SHA256 b018875453fc414186b8f5e38d863cdd565bc4455f4fe8b534cf3d356de3c1e6
                                  • MD5 SHA1 SHA512 SSDEEP

                                  the-real-index

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                  • Size 3KB
                                  • SHA256 9dce50312d7a5af82c559d8ffe1122c1285e38fa25e267ff455cc809eb39fe97
                                  • MD5 SHA1 SHA512

                                  the-real-index

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                  • Size 1KB
                                  • SHA256 428f4c447fc7a8b8ebbf97f4c34d807aecbf8f5d38a5d21800654dcce81ae85e
                                  • MD5 SHA1 SHA512

                                  Network Persistent State

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                  • Size 2KB
                                  • SHA256 67486d0d084edd7d9c40c5560726c0017783c035e8b760d3b48c2967051401b3
                                  • MD5 SHA1 SHA512

                                  Network Persistent State

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                  • Size 2KB
                                  • SHA256 eef3630ee7f1531277bf7753ef15617086a0382b5f5f2c60dd7887e1c96fab6e
                                  • MD5 SHA1 SHA512

                                  Network Persistent State

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                  • Size 2KB
                                  • SHA256 71aec7c44e224aa006d2e4b9d9051a864a6c9eb7adb4878823fcec73e3c2c2ad
                                  • MD5 SHA1 SHA512

                                  SCT Auditing Pending Reports

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512

                                  TransportSecurity

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  • Size 1KB
                                  • SHA256 98fb672f2cb0ddf1a9fad56cc06ab1791c9b304b0ac12e697add03c7c335cd21
                                  • MD5 SHA1 SHA512

                                  TransportSecurity

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  • Size 1KB
                                  • SHA256 696fd285c31541277f69a79e60a70da1bf00b03f9a74c8a62f9f43c703bf781f
                                  • MD5 SHA1 SHA512

                                  TransportSecurity

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  • Size 1KB
                                  • SHA256 38d693df9a692126d98b5b4cf92f9aabc2d2db45244dfe017028464936d5b68c
                                  • MD5 SHA1 SHA512

                                  TransportSecurity

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  • Size 1KB
                                  • SHA256 0f277f1d1c153a252c6f6460525b9c2d4522402e471104d725de9c580bc11ecd
                                  • MD5 SHA1 SHA512

                                  TransportSecurity

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  • Size 1KB
                                  • SHA256 36c692577b5757c52d5e4bb54e027618a3f33e6137064e678278a1322516acb5
                                  • MD5 SHA1 SHA512

                                  TransportSecurity

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  • Size 1KB
                                  • SHA256 b91fb0174516999b9b4ea6d9e9561105eaed642a63a0f373440b989542bbdd92
                                  • MD5 SHA1 SHA512

                                  TransportSecurity

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  • Size 1KB
                                  • SHA256 91c2c66b9889d10f6ab84015bd91988f21bd2fd6ff22e25f4f0472215fcb8022
                                  • MD5 SHA1 SHA512

                                  TransportSecurity

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  • Size 1KB
                                  • SHA256 7c5ac56fdcea1d92ca0e483767bd0a8065459cc41d557afac530eb178e536189
                                  • MD5 SHA1 SHA512

                                  TransportSecurity

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  • Size 1KB
                                  • SHA256 c0268ce950781cab12c7d38db080bdb712624b9e59787e45748abeed9c557ed0
                                  • MD5 SHA1 SHA512

                                  TransportSecurity

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  • Size 1KB
                                  • SHA256 3099dafe9c49a19d2991c51cb3eafc5e095c45f6298643fcdd3bf9cfccdfcc70
                                  • MD5 SHA1 SHA512

                                  Preferences

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                  • Size 6KB
                                  • SHA256 5f18c62192aea96f9815eacf86c26348cd27eb0aaa20e5f50fe1eaa664d75ea9
                                  • MD5 SHA1 SHA512 SSDEEP

                                  Preferences

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                  • Size 6KB
                                  • SHA256 dde23305efabb11f58df798577488b4b91d3741b5cdc3895bae3f9d61f3112a0
                                  • MD5 SHA1 SHA512 SSDEEP

                                  Preferences

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                  • Size 6KB
                                  • SHA256 aac14f41764140698241f439f69bc1bb8c083d4024837f730d0b6ff2f1b4b84b
                                  • MD5 SHA1 SHA512 SSDEEP

                                  Local State

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                  • Size 250KB
                                  • SHA256 41543f75f268d4093e234f1abe9a7fc8d5ede653e24425243c13317765f1bacb
                                  • MD5 SHA1 SHA512 SSDEEP

                                  Local State

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                  • Size 250KB
                                  • SHA256 c76963c634cd74a2e8c05ff5cecd39a452db1a60a06986514e067e64a00e1b82
                                  • MD5 SHA1 SHA512 SSDEEP

                                  Local State

                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                  • Size 250KB
                                  • SHA256 ef31c30045db5067b3c137c2e2f28c4c5440a75604890102af848c8e88c5e2f3
                                  • MD5 SHA1 SHA512 SSDEEP