Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/04/2024, 09:20

General

  • Target

    http://podnuggets.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://podnuggets.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:920
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb989ab58,0x7ffdb989ab68,0x7ffdb989ab78
      2⤵
        PID:1564
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1568 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:2
        2⤵
          PID:2032
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:8
          2⤵
            PID:2760
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:8
            2⤵
              PID:4164
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:1
              2⤵
                PID:1048
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:1
                2⤵
                  PID:4528
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4156 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:1
                  2⤵
                    PID:1032
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:8
                    2⤵
                      PID:2144
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:8
                      2⤵
                        PID:1888
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4800 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:1
                        2⤵
                          PID:3424
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4732 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:1
                          2⤵
                            PID:4044
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:8
                            2⤵
                              PID:3080
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:8
                              2⤵
                                PID:4700
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 --field-trial-handle=1868,i,2756774774720131646,1647032657864251244,131072 /prefetch:8
                                2⤵
                                  PID:2860
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                1⤵
                                  PID:4500

                                Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4b60acb5-a4eb-42ad-821f-56bb02e45632.tmp

                                        Filesize

                                        7KB

                                        MD5

                                        551d224a5c5ce9b861182d4913e2da4c

                                        SHA1

                                        7493e9343b6c1a78968f8f3f18a6302f2c872388

                                        SHA256

                                        c1aafe1e6791fd9c1a931168d8bf23832fc26dff83dfee5f2f82aa2919e66578

                                        SHA512

                                        de5e5518e565ba80ee381fadb89d91af3747dbba85423aff41efd85ee042419b1ae0b5c6c55775bee034d8065b74a321d11681cbf835f468992fce11f70df594

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        672B

                                        MD5

                                        e5b5e8475d3498ffaf27711b72fa9e2c

                                        SHA1

                                        4d08883a681894a76098c6c25dbb28a4839977d3

                                        SHA256

                                        ac8eeb68fd253ae2beaca7c7f593d6d94ae989602246c5e94f40dc0eee7ec7b6

                                        SHA512

                                        7ba8a240d1c49728fcfb08c19fc697c3a8f8f692d3308deecd22e639a060f5512ae6ac4250f26c00230d8a480ab3db0d35bdf466f17e02cd510fb20801f89c2f

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\444eb37c-3fb0-4bd8-a6a9-6804d61794e4.tmp

                                        Filesize

                                        2B

                                        MD5

                                        d751713988987e9331980363e24189ce

                                        SHA1

                                        97d170e1550eee4afc0af065b78cda302a97674c

                                        SHA256

                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                        SHA512

                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        6KB

                                        MD5

                                        69b1ac4f3b9eeecbcde8c5529462c13f

                                        SHA1

                                        1d397c18463ccd1c827f676caaee6ca4331391ab

                                        SHA256

                                        c2a83db7a11f94ba9143d76317d8601b16b66882f688716f053f9c1771132e52

                                        SHA512

                                        148f92e0fb9add05081ce27ea6932bb4ed474b2eb47e9888acdec10233acd84e9c522208c75532d8138d04e32d9abe156bb4c806974a4912e7759c21296c5ff5

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        2KB

                                        MD5

                                        581c9695ad9eb27bf6f74f241429c993

                                        SHA1

                                        00bd91da0426d9decde930c2d2127e3b550f23e7

                                        SHA256

                                        d890468f3063713d008dfa54b23f19905383f012b7e6dcf77441cc82b4b54219

                                        SHA512

                                        9fea92be19a07735d2261dedb5de90950090487bc85b1847f4d51a2bc49bf638bcb196fcab58dc97518e9a354663adf5a89bf63587b6ffb470eb3647a788b7d2

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        09e59f5b54cb1082a1db1ad4b6025239

                                        SHA1

                                        c20397320ade9b94dc3586601cccd29ac456836b

                                        SHA256

                                        0398cce17321b9cdf4cfea8a49e870f995206e20c24a1259d4891edf2d0fe128

                                        SHA512

                                        2c7c34e4a6e6768958763c0aaf7b2bc96e1ea73a854c4a45e31f9963a824e6631872b19929de91f53083dbfdc514eb3d253c96c9e00a314aef6514fb8cf083fc

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        128KB

                                        MD5

                                        fdbad81f19999619b6488acf07aed5e7

                                        SHA1

                                        1effa1bd7661ca3c0f37f9e4c0f4f93b1921fbba

                                        SHA256

                                        bae9059253f418a485351eb1239aaf01829d00244f4cbb66af5e07c0ea585de9

                                        SHA512

                                        83e69904f143f0645406a85b31426627a3dc983b2920128af01460efc9ed02553460d8abcce5303be080525b452f7c2322d184e551837b609f0c269e0bf54272

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        129KB

                                        MD5

                                        a8f093777a1291385d39841d8fbc093c

                                        SHA1

                                        03dfddeb4c2b6cc9d76e62776b347ae425abb3cb

                                        SHA256

                                        3448a5eca593c35006af66481b10162a2a0c6d6ca75032b75b515e8c7c12abd5

                                        SHA512

                                        bd68a8f4e8f128fa64888e61318c576a348256e4631d06535ac7884477beaf77f9ad60a4c06b91e70e39f88faa5ff03020c59da6befe3f11a2aa005beba9fbe3

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        149KB

                                        MD5

                                        700baa868c54ec5e52a2821e689836a2

                                        SHA1

                                        af1343b7172aab3d8743e0ee9e04a10190833526

                                        SHA256

                                        e301be054a796dc0ed9030944e37274f865f7a2bcecf845838eb12a3138f40a7

                                        SHA512

                                        c2abdb6926423b0a59dc7eea5fbcb1289ba06dee9bf2da1a50105e72d3598d66dfbe7d8ae68b870f114a0de53cd28d055018a2884eda5c84a6122a9fb2698867

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        129KB

                                        MD5

                                        2ebeb293e9029f15d464a657d0a63b72

                                        SHA1

                                        75df664b9b68ae2e2e15654bda4b16213271f8aa

                                        SHA256

                                        241c526464c6a1d4cede8b5029768c490828c00153676ef77919b2bf1cced4c6

                                        SHA512

                                        df959b616ac121392a1670cd0bdc97dfb81194fae04fa0c2eb330ff4241fdbbaf88a041a91d40618209f8157e78a901d2d9abfe31ec1787ee7ac0056243a4dcd

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        129KB

                                        MD5

                                        16e95c8847d21eaccc6d2617972a6581

                                        SHA1

                                        b5f72acda9e87f846291c650ed50a45c9f6f8195

                                        SHA256

                                        50e9b19626f91bc2d9827f6fe7e90f79be674cc16015728c4d50e8a62c3acd54

                                        SHA512

                                        0fb363cc2fa7a69133fa4f445b765399122ea9afb3d855664eac14126309b4e4ed7701d3dc17906b93f85ce289e6a39cc09625b21083cb3621713da7bdf40678

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                        Filesize

                                        87KB

                                        MD5

                                        a4f6d24ef5a85e2b72454d8ba7914626

                                        SHA1

                                        ff40de5238e1c17b948626b2dd904f2d28bbac39

                                        SHA256

                                        bd8260e1d4e12f59aca66ae331a23f394334b5c202a714c93d31fc1a212c85f3

                                        SHA512

                                        89faf6e03bf8743a9d4d90c294cc17f28342245bb7d384a67d389f7690c579e2d884e880cdcd6c67c7f88821024c82e6b4a3da158eaa90500e6353f916a76204

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe583fe2.TMP

                                        Filesize

                                        83KB

                                        MD5

                                        02352ef61b1f9b6a20f3ff2f0435f7b9

                                        SHA1

                                        c99e38a80bde8ef5832efbdcabedf5faaa5b15f1

                                        SHA256

                                        47e15354c56ba5e329bebdafcb408644c0c0e9be4cf9cb0d8a511f307cf97ba6

                                        SHA512

                                        7142d0a8e31eecacaeae7ebf6b3ee36e1a7001815a74d267bec701c16ec854be7d1e4ac3929454fa1a8b7e36c83f4cd48cf49dbaf854db9065bb76df27b6d351