Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2024, 21:14

General

  • Target

    https://www.dvor.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dvor.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa73feab58,0x7ffa73feab68,0x7ffa73feab78
      2⤵
        PID:3400
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:2
        2⤵
          PID:1080
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:8
          2⤵
            PID:4188
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:8
            2⤵
              PID:3736
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:1
              2⤵
                PID:3752
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:1
                2⤵
                  PID:1448
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4460 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:1
                  2⤵
                    PID:4076
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:8
                    2⤵
                      PID:1832
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4124 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:8
                      2⤵
                        PID:3564
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:8
                        2⤵
                          PID:4404
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:8
                          2⤵
                            PID:3188
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:8
                            2⤵
                              PID:4544
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2404 --field-trial-handle=1888,i,17473809151363157390,18274801748719444357,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4836
                          • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                            1⤵
                              PID:4916

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e

                              Filesize

                              201KB

                              MD5

                              f5bc40498b73af1cc23f51ea60130601

                              SHA1

                              44de2c184cf4e0a2b9106756fc860df9ed584666

                              SHA256

                              c11b6273f0c5f039dfef3bf5d8efe45a2ecf65966e89eeb1a6c2277d712ae9fb

                              SHA512

                              9c993ef3ec746cbe937bbe32735410257f94ceb6f734d75e401fb78dc2e3ab3b7d83c086086f0e1230dc8dafd5328f9af664341eb781c72e67c4d84d1f6c1112

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              672B

                              MD5

                              8b08b7cf1bb2939d730ccb41c7fa4e43

                              SHA1

                              0ccc32987fcde2b5bb7828d737b29762dac74b4e

                              SHA256

                              2573222905c57bf619b5cc588eee6a0db265bbeceaa7047933c729dbd97b5f90

                              SHA512

                              2257a13a21c2a49ff192206a430910df7061fa8608fce7f988fc40ad79a46f57f15f2abcaff06e964c7518f4944b55e5cb182c49dc8c28038efc037428add8f1

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              5KB

                              MD5

                              de67556c61b65c373f6e205d6ea8edfa

                              SHA1

                              a1a310febb7d3fa8a0689fd0d282073f883d19e2

                              SHA256

                              194751ecd9a05e2c3fd9dffd3f60ac6b15f1188d85fe76a2700d336df1ec45b4

                              SHA512

                              270515aae4cd44e5d42067d36dcc08b71075ded70678797ce64ce8865c53d96a712c87791d6550386d495dd9d80339c73572c3fd15447f10de0ec780d2d7c6cd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              1b9bea5ab2647e8a114d4d4fa4606cff

                              SHA1

                              f03d6ecb2726e9440b1ad5584a107fcd38f3ea0d

                              SHA256

                              7e6df3cd5b69ad62bbae31c9167ae6e7fd1336cee013cf8220a3a4021f345ca0

                              SHA512

                              039fe4e616646f5f61c907e050051e9d124f2f592add2e5eb3464b00fa812a8b164eac644d7794d0b1c9f68aa126ecbbea6b3f85efa63b5a9d89697f992c00d2

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              a5cd659c54d3a0dd0a7c70a37d40289c

                              SHA1

                              a3bc408f51ecf82fa739d555f54e41d1caf6ff44

                              SHA256

                              a5641dbbfa579959332b0f5b21e032f79bb8063435112fbc31b13284ad2ec2bd

                              SHA512

                              fee1e7cc8ee94ee583ba69153609a310e08430634a73154ce39807fdac768d800d7c8da3db2f0b4283fce90c545bcc8a552e848c79016c7a0bb3e2c4272b9577

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              d5f6c0347429dd0ac2c42c7d31b4b3d5

                              SHA1

                              fdb732bf1ef901de989a9498fbfada23d39adc74

                              SHA256

                              1bb96c8cff3ec5b0828c3a6bb86ebc683dac3f2b221c0fb762a5952512ea544b

                              SHA512

                              a488cc2e987e59cbb7e56d7bb9b4b88d8990b4ce5cdb700a5bfa02932ecadc80f76a2dcc82a8bfee9def2b1b093354153098acae7e9dd38d923e22ebf2acc03f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2edd15d5ee76bae4197d3dcc6e5bf0505580b8e1\index.txt

                              Filesize

                              107B

                              MD5

                              02a09f3b446fdd3adf378496d17a3dcd

                              SHA1

                              d2571b94ea049d9947e3f724eca0401e5d6171f0

                              SHA256

                              4b98b3aa92b7ed4a6be65a332f11413a95e75f5fc8cee42eba25e25ecf758863

                              SHA512

                              f8d1419eb34baaa6655179e68d84adc447607681b6cbe0fccc8fe637d06d79164b313c284aae7139b3592f6bfe6281a02c9f4033fa68017c04878d7b01a61ba0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2edd15d5ee76bae4197d3dcc6e5bf0505580b8e1\index.txt~RFe578d5b.TMP

                              Filesize

                              114B

                              MD5

                              9561b726b2749f14fb48a869ddc08654

                              SHA1

                              d4e7bb91c773e61807599b0a3919f055e4708c27

                              SHA256

                              1d9a447592c1bf9469a46961dba249d6ce25f23f0e65bf69e614dfe429976c64

                              SHA512

                              943d97e3081a6fee1742ec62e52df9d1fc1b7145188222c39d7f9e197a9191a41b4d9118b4b834576bd4186f2c5c0a6e7175b60276472010a112710a7e6036c5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              252KB

                              MD5

                              b73b4cb4484fdc35f2bed29097d3edd6

                              SHA1

                              ec046b8352ca6101e0afb5b5ab3dfd1ac3e7adfa

                              SHA256

                              d078d8d76930edb5c4c068eaa3e7cbed2248473a3732bcaec94e46578ec35177

                              SHA512

                              8d95160387063ff305b435fd7ff2358c1a372e18edce505ca9e3665dceeaf9e0af3d7fd139269d96a8434244293d7635d66288a650aa035f66c95bd98ec9fdd9

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              252KB

                              MD5

                              73a09572b0202bd112dcd9a3ea7de26f

                              SHA1

                              02104d95e2216c980e849f722cf79f01784db60c

                              SHA256

                              a82f242b722c28dd83f77856231166a48e52663acc7b19e74900abb6a797beb3

                              SHA512

                              25e804e87e1851acca73643c16cd379190f736928ed257750875f811eab8f70a5dd27c0e9b4a409f9e01319bfcd8f050267a5b75fe3910b06bc90b5116b73924

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              252KB

                              MD5

                              a85ac8a4df9fec3db3b151ed672aa850

                              SHA1

                              536a47f000bd9d29776cfaafc8b0968b61c73193

                              SHA256

                              ad6ee198b3a6871193146676e1c22e6b638b60e0af5c7f22a04d016d6e00f84d

                              SHA512

                              45b0e44a8fa6da2e81488e184d765995bfa1753377141f0ed78dc2a46514491a7cdd3f8bb4a02ff8eb0df08f028c1737f75440cb10350677a588ab062ae61199

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              272KB

                              MD5

                              93e6545f700b82e4eb0ff45ebd741dcf

                              SHA1

                              24f9f79e1e448f7de7cfea0ee2c370c1302f2cea

                              SHA256

                              ba61975edf07cf07d29c7c925711eaf47c85efe767a51a6cf087f2c1c1fabdc4

                              SHA512

                              15d58a1a9fee5efa26a624aaa094baa6f3ee3033c5cdd28bbe9bf81423a2b7863287a60afb865254d02a9af853942d0abcca8a3c74ee93e58ae4a343bfd57a8e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                              Filesize

                              91KB

                              MD5

                              e913de9d80e08787949a083f95910780

                              SHA1

                              ca15861c01542bbc9371d59d271275f70b6ab6f1

                              SHA256

                              f54d2119fcc1f9dd737c2cd6337e966dbb8f31daa4d75d1737fb7b6562fa1c73

                              SHA512

                              548a3ba5ea437d6411a4b14ca0841389810457408c6e9b9a44375ddee7dbbc5fe3ba739cbc56bc9be02acaad3e66e64f274f89fd7dc21ebf3ac313b2dbcffb4d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d188.TMP

                              Filesize

                              88KB

                              MD5

                              e8caab146089b0f872d7ccbbc4d0d723

                              SHA1

                              acfb9f94599906e1e667243e0edf628b9b2ca382

                              SHA256

                              b2c0767cf24f574743c5da2830b2a7d39fce5135e717a2c308cf81638686b18e

                              SHA512

                              4aff86bdcf74e67203396c501f4b5dea3971f3f4e872aa2d9d41e357baf73b29ec5cd71458e6e2bc8c1f793bf8bb74cd81b10b9dd0b98f361f68f1e49bd21a29