Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-04-2024 16:46

General

  • Target

    https://click.email.sportsline.com/?qs=90c484179f940158ed6a5974567adfc3e5601ac03f9368c260e6a57b1e861fc1e62a60bad50d9cbc15b3a78438a8bf5e4ec8039ad39a5aead2ff3eca99309cb7

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.email.sportsline.com/?qs=90c484179f940158ed6a5974567adfc3e5601ac03f9368c260e6a57b1e861fc1e62a60bad50d9cbc15b3a78438a8bf5e4ec8039ad39a5aead2ff3eca99309cb7
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:888
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc62e8ab58,0x7ffc62e8ab68,0x7ffc62e8ab78
      2⤵
        PID:4560
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:2
        2⤵
          PID:4812
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:8
          2⤵
            PID:4700
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:8
            2⤵
              PID:4468
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:1
              2⤵
                PID:552
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:1
                2⤵
                  PID:4480
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4496 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:1
                  2⤵
                    PID:2152
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:8
                    2⤵
                      PID:1768
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:8
                      2⤵
                        PID:648
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=968 --field-trial-handle=1788,i,13588390924066362509,6564249110161424119,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2012
                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                      1⤵
                        PID:3916

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        1KB

                        MD5

                        2efb0cb4b167341154572a0eb85505a9

                        SHA1

                        e7d5364cf48ea2c620b60c8e1097d1b577c44e7b

                        SHA256

                        551e6a997cb620df3bef7bceb36d5757e3e42b12c9ec1e39ae759e4d70f9605b

                        SHA512

                        e96fe8e375aa57a07c2e9f51b7d1825f90a12233ad41fd0ca0dc09f6aa03dccd6863b39ffe8fa4ab35888f2da6f9a5c72f7d4f17c3931f34a6b1fa89d380edb2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.sportsline.com_0.indexeddb.leveldb\CURRENT

                        Filesize

                        16B

                        MD5

                        46295cac801e5d4857d09837238a6394

                        SHA1

                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                        SHA256

                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                        SHA512

                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        cfb0aaecd553f793fb17d17ec8402790

                        SHA1

                        3409926432a6120ecbb64c8e6a1cca2ecf6e13fe

                        SHA256

                        d20ba2b2bab6ae211ee19cd21bbe08d8bf05b78b242aab0737d4538768922713

                        SHA512

                        992c7d84e942ed35170923a392fd3c780372f1fdc0bca60ed8205af96405d400041867aafa1b31c589a4f51c0fb160f204138031542200e0c37ddaf99eefd7dc

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        b844256dbf4eaf4bbf09c45d8d6e4690

                        SHA1

                        b62a9fccb29a6c194b602ff42d9b701082c9977b

                        SHA256

                        457973feabbe5214a85edddcf507cb62308b0a13bf7668ed9eddafdfa34014d5

                        SHA512

                        c3c381a918623468a3b4f75b1467bbb8b7cdc3824d7f0886592546977473bf5c9c025be8f76ffa70dd9687f5a54bdc1c9f7d2329b7ed44359908a420385bd8de

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        4KB

                        MD5

                        cdfb38fc4bafdd0dac1cd32a46a92b94

                        SHA1

                        7229ebc2b9035b22df42a6a616acc2a212b8b144

                        SHA256

                        00845edf061c1ae57d0427374df6754139f4856ae9e1b5d481d110aa1bfd8a57

                        SHA512

                        4cb0dfa8e0ec407ffcfababf7f0bfa813bfe5e7b41369e249df5b9e33f8c17d053c7f821ac59373c7d6113e3b6db3413a674adc5d9f2434e42f15c06b42d52a4

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        2KB

                        MD5

                        3ad3daf044c251016ccbf59d6d2f520d

                        SHA1

                        5827f7e59796ae5d483343a27148d5806c905cf5

                        SHA256

                        90f8d224f9ba1937e8d1ae79574e1493ce66716ce45d83835a75d2a2361e5589

                        SHA512

                        c9915ec7f922b77d4e1d8d539bc315f3cb41dbc9dcafbb4b0f2c98535605e00993a59b0e76eaa8d06a6807d8de0147a8d0ca94e6fb7ee40835b6356c03cde16f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        7KB

                        MD5

                        25e0608228c40cfc72bc638dd03942c9

                        SHA1

                        93e869533b43cfd5e0a7718ec628ac54408c3bf7

                        SHA256

                        1375daa83de3ea775fe8cc03fdcb1d9bc356b07b41f4f35557487402fb4a27de

                        SHA512

                        960611352a93eebb68b53d8eacef6670f5e2b0037d96d43dfc0ce40f125483149b2d59b4862dd00b6077d967cf9739806d3d20a4f801dc8e1cd4228a8c5d03f0

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                        Filesize

                        96B

                        MD5

                        3eeceb82780ccbc4ca63043520f40440

                        SHA1

                        879af43380c008a9c1e1b3ecdeb8da1578ff5d75

                        SHA256

                        79065d074ba21785fc6b1b45e893782f1c4bc2e0ad776303f4511cd37e2adfd5

                        SHA512

                        3723629f4630f46d2ca07ffc7d0097df99d0c7303cc774df2921b7fed1476962879225b4106e64121c4429488018ff393e32decb001ba1df6ef23237cb5fac36

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ac5d.TMP

                        Filesize

                        48B

                        MD5

                        5978753cdff00a97aebfb92e5a0bafbd

                        SHA1

                        f39a9a87883e9ae2ee8b20d2058157ccfbd1cd4f

                        SHA256

                        6ca162f327157ca7c8d9ffc0d8e531ed0ca564d646049eadf93276e144e15560

                        SHA512

                        9f8288bf5ada582f9b1bdc70cd43f3205febd90db43f99ff4a0f2c42d4ce589c859bf78a0b8bcbfa63caf189f170ded259027936469d7817630a1b22cb180869

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fcf2a3b7-7a29-4d87-9cd8-78f1747ed831.tmp

                        Filesize

                        127KB

                        MD5

                        86ea33d5c79b8cd44ed27151d0a608ef

                        SHA1

                        f916940d0fae407e73c5eaf7a114c2d7ef94d9e2

                        SHA256

                        5797e500a640b5d0ef4a796fce71617ae888c03f715cc8150973ca7ca8ded16c

                        SHA512

                        24c814f4e88a707fb13a0feac069cc723462f4aee2bbecda70108840b0b649535eb46678e69911e120b41acd96e8aee459881d4732e1f1155af45d101c16d5da