Resubmissions

18-04-2024 17:25

240418-vy9p9sad68 1

18-04-2024 17:21

240418-vxdlfabe3t 4

Analysis

  • max time kernel
    56s
  • max time network
    57s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18-04-2024 17:25

General

  • Target

    https://7ink.ru/ufyQQ

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://7ink.ru/ufyQQ
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8ffddab58,0x7ff8ffddab68,0x7ff8ffddab78
      2⤵
        PID:4652
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1504 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:2
        2⤵
          PID:3500
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:8
          2⤵
            PID:4296
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2160 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:8
            2⤵
              PID:248
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:1
              2⤵
                PID:484
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:1
                2⤵
                  PID:2692
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:8
                  2⤵
                    PID:4216
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4636 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:1
                    2⤵
                      PID:2688
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:8
                      2⤵
                        PID:2740
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4640 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:1
                        2⤵
                          PID:3904
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4052 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:1
                          2⤵
                            PID:2584
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:8
                            2⤵
                              PID:2580
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:8
                              2⤵
                                PID:3408
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:8
                                2⤵
                                  PID:2436
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5116 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:1
                                  2⤵
                                    PID:3296
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4164 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:1
                                    2⤵
                                      PID:2012
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4848 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:1
                                      2⤵
                                        PID:4784
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5068 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:1
                                        2⤵
                                          PID:3776
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:8
                                          2⤵
                                            PID:5008
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4108 --field-trial-handle=1832,i,2145325051527152348,12381158182503786066,131072 /prefetch:1
                                            2⤵
                                              PID:4616
                                          • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                            1⤵
                                              PID:4628

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              360B

                                              MD5

                                              c06bd869048d15ad2aaba8b4e34d1e46

                                              SHA1

                                              ac3095df317c53c099de7199fe424370ee4f311c

                                              SHA256

                                              4682f7ac645fadbd82387082aee37f6327a073848dca19123a187cdf2e043b0c

                                              SHA512

                                              c50e284fd81db16fc69b2f274de8d95199a4eede8e123e0633f041e9ba3d63b4dc91d741c196478244f327ed825b6ddde5fd1ed9d3da1129725c195af23d18c8

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              46295cac801e5d4857d09837238a6394

                                              SHA1

                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                              SHA256

                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                              SHA512

                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\Paths\MANIFEST-000001

                                              Filesize

                                              41B

                                              MD5

                                              5af87dfd673ba2115e2fcf5cfdb727ab

                                              SHA1

                                              d5b5bbf396dc291274584ef71f444f420b6056f1

                                              SHA256

                                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                              SHA512

                                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                              Filesize

                                              2B

                                              MD5

                                              d751713988987e9331980363e24189ce

                                              SHA1

                                              97d170e1550eee4afc0af065b78cda302a97674c

                                              SHA256

                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                              SHA512

                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              2KB

                                              MD5

                                              af51fe071625e20c03a53788bc725488

                                              SHA1

                                              1827776a51eda8c26cd021bc6999509ef740d038

                                              SHA256

                                              a898276f74c6a91c4d8e259f3976434292df3a1a5ae999473f531a2868d7b54f

                                              SHA512

                                              20a0834171c79b6e1e84717235cd8ee698727d3bf1694ac5468db3ea2606ba4441dd0f2e7e49087d2e47b9ca48f0b219ffb8f47b98a327628e3d5348ed06f799

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              2KB

                                              MD5

                                              589281efbfa7edd21b472e0b7f25c561

                                              SHA1

                                              40918a82d0fc8813d9852613f73734f66ff77c57

                                              SHA256

                                              51fa406cfb2bfba703725a11085e1e1220ff141f2ec6381e03bc214b5ffd3abc

                                              SHA512

                                              d9811105ef84f897a4045b408240be0f464e6a86a1c62ceb57a31a869a370f73fdba3ed88a8fb8ec165c6cc40e792ac12334b7a2d656c61f85385f7534218f23

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              761ed47f1deb6371646a04867f9c55c1

                                              SHA1

                                              b8298f8b65288ef882e34e4088815beba3728654

                                              SHA256

                                              d1b9baa5d895005e5a9a6e32e42425525bee66b643f39cbb6e026d6a6140f0d9

                                              SHA512

                                              4fa3eb2c63a9f900db7b1cb41f10e71ac442f7345691e1c040db0ad13a722358ff28948019b1d04aaf71d4fa0030046a1318d82f751af952f13c308c8cf6ff72

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              0d103ad46279b8dd1880a86cf6ea1203

                                              SHA1

                                              9da0dda702912573c14f5153140da8d21e4fea37

                                              SHA256

                                              ac26dd9a729212a08071199bc1e6e96a8127e5f539a8a7bf61f4f58ab4f9e451

                                              SHA512

                                              3e97a244e70bed85d3eda795079cc6dc48dd9db2339652796b10b00cd36c3dde1988b200353fde34ad77ed73f9ee27141581b947f51acff185cc74074d7e5641

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              129KB

                                              MD5

                                              3a79eabed55ebf3f3f1078210227367b

                                              SHA1

                                              30ce06590184aa94bb62e9baada597857d8d62a9

                                              SHA256

                                              5ac1cedb4ab53cee7996a82260e0b90189d9b79f7cb4ee90fa1cf571199a4f9f

                                              SHA512

                                              41c070e7ea0dfef385b92a5671855c6067a5c46b2f6aeb5975b18947c50236fd12437e4ec8e261edb24475fa860017f406a4186f24e72dec90c3ef2b133c9c86

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              128KB

                                              MD5

                                              11135306be17c20dba1099021cecb696

                                              SHA1

                                              ad85006b96e864b2c7aff1c948ab197d905a1060

                                              SHA256

                                              4f9ab6b4639b49cb51aceebc5f299bac96226fb4826f6441e47cf72e57bc386b

                                              SHA512

                                              01b99aafda88b4a1a8dd57fd667b93a552a8857812b67135bc7d191e25c95a40bf91d73269dc6f2ca6a39963758e880621f9508744b340ed5e1d4f6449d12dd1

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                              Filesize

                                              87KB

                                              MD5

                                              a2ed10823527fa87cb429a294965e93c

                                              SHA1

                                              4aa3c71c57f5e7874a626b896d1def8dd1ca197d

                                              SHA256

                                              d8755276746489773b1c9e907bb8b4ee22ff89449ea698abef1e1cee5579942e

                                              SHA512

                                              7f4f836bdf06a8965ab41a03b07d233a5c9c9926c0f79a2d05228e06c6d9f79ec4d2c5ef641fe0c0de3f96b18bdefe193a528fb77ad9b96ed9d829d4647c00b1

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                              Filesize

                                              86KB

                                              MD5

                                              ff128b1331dec4bfb10f04ce8ab9c58a

                                              SHA1

                                              4ce3a5423da3e360c77f12f8140ce924fcd3b95d

                                              SHA256

                                              7f162eaf276cf92514799bc3359debf6516d5989201a5aefc5e0e62395690285

                                              SHA512

                                              0a635ed2a72eed097f46d4b5acacd75509569c7953dc4c8a9dc79014232f68c968183f009849ea457149672fd49f036c0cd169f1a7825c41dac2644919636d68

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d38c.TMP

                                              Filesize

                                              83KB

                                              MD5

                                              88e5a93db73c7ed591c6346eed036a6a

                                              SHA1

                                              780351eae40ba839bfde90719520347db07d900d

                                              SHA256

                                              603c3ecd431846675117ad990e7752d1e71d2e56d079aedaab68133b7c949408

                                              SHA512

                                              e4d9956b74434c8012ac27aadef3e3163d2187ea433ea7613a2a8111a8c43c7525f18f0c3aa5a8400eec5e132038a4ef07a7d333a661e95dc27fdc2d34dca7e6