Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 10:24

General

  • Target

    TangoGen.rar

  • Size

    43.6MB

  • MD5

    58499bbb694ff3a09362d57e35c660c7

  • SHA1

    8fb1d6c6ff24b9710e78fddce0a3ed20201ccf96

  • SHA256

    eb6f8f2a7f814d765640c5e6422921576383c85183677c8c1328f846bda5906e

  • SHA512

    bb60444d0c0e91759bc6737a79d1cdb1e678b853fefc0e254a30d3455dcbd4c929847272e2a8f8ef779b6991f1aed44691a10a772c9920dca2a2298fb9a22b89

  • SSDEEP

    786432:vBD907AA6x8fc79JOuWYdlWp7vzi9DzsOfRuCgIyM25jtJwiS7Sh7IbaHuFJ9W:ZD906GW9JOufd99DwSRu/z1avJ9W

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\TangoGen.rar
    1⤵
    • Modifies registry class
    PID:432
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4984
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe2168ab58,0x7ffe2168ab68,0x7ffe2168ab78
      2⤵
        PID:4892
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:2
        2⤵
          PID:4684
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1676 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:8
          2⤵
            PID:3672
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:8
            2⤵
              PID:1484
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:1
              2⤵
                PID:2436
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:1
                2⤵
                  PID:3036
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:1
                  2⤵
                    PID:4388
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4348 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:8
                    2⤵
                      PID:5012
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4360 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:8
                      2⤵
                        PID:3360
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:8
                        2⤵
                          PID:888
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4912 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:8
                          2⤵
                            PID:3988
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:8
                            2⤵
                              PID:1048
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:8
                              2⤵
                                PID:1460
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4724 --field-trial-handle=1972,i,9685751697426612032,8424442473042211834,131072 /prefetch:8
                                2⤵
                                  PID:3616
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                1⤵
                                  PID:4204

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                  Filesize

                                  2B

                                  MD5

                                  d751713988987e9331980363e24189ce

                                  SHA1

                                  97d170e1550eee4afc0af065b78cda302a97674c

                                  SHA256

                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                  SHA512

                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  356B

                                  MD5

                                  05801123a0848079d4fd4196ac717939

                                  SHA1

                                  ae5115d9290ba1350f947a3519a266dc74832fa3

                                  SHA256

                                  efcdb44edd3f51843702e5fe4512a77e78592613b0aa92e8039338f44bad159d

                                  SHA512

                                  5d2b2f80601fe2fbd9ad145bec9508e31cbb5956e9f01098fa4c9f24b4c79ad03b904d79f80106b8cc04d8a4e519fc579db967702b73e3a7e133d5010a331952

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  7bcebc0845b8a66337542afd7963f734

                                  SHA1

                                  41c012755be68853a41b5b9ff172df19582bff40

                                  SHA256

                                  40d4168eae8277b23d2bde9deb5be7c6a1ca85514355d8228553f5a180b35ea0

                                  SHA512

                                  630f30b73c3316be7a62dcefa5dc842e4451f47b1e55b124d6b49a75bad7a6960f9216fd293bdf07f366541dc1b6f20eede7986a6e1676d5d812dac23ef746d4

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                  Filesize

                                  16KB

                                  MD5

                                  9b4ada8e855fd0bb751380c2c24692c0

                                  SHA1

                                  07d7067514d06857ad38ffdfb1eccdc5e9abdc65

                                  SHA256

                                  9b28a3d1ae42dc646c88aa34449a29b6203d067319d6fa50742bbdb3da5b33ce

                                  SHA512

                                  cd725ae54cac280b8cc53c79b6da93833dc5d7500124f226129ca22e36a03ac6e9a5153148693e99849219efc396830d6eca26ffb11f6ee4ada0a222d759f3f9

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  252KB

                                  MD5

                                  cef686e3ebecf610340959d5fbcc6032

                                  SHA1

                                  f2238706efe2444513f2ca3ccaf78c641cd95864

                                  SHA256

                                  b6e027ee3354acadc18606cd66782d3b002051694e5c613a808eecabc5f4900e

                                  SHA512

                                  7ecf9df49db4056ecbe5bdb65df97571f6b833f3e6467b97a7fdee6b6904999be6006e3bd10e315606ce9a813feaaa1069ec539c834e96586f6b41dc6fe58c56

                                • \??\pipe\crashpad_5056_RNYZRRPIQULSZGUY

                                  MD5

                                  d41d8cd98f00b204e9800998ecf8427e

                                  SHA1

                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                  SHA256

                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                  SHA512

                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e