Analysis

  • max time kernel
    599s
  • max time network
    603s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-04-2024 12:00

General

  • Target

    https://playmods.net/download.html

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://playmods.net/download.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff07a6ab58,0x7fff07a6ab68,0x7fff07a6ab78
      2⤵
        PID:4996
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:2
        2⤵
          PID:2228
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:8
          2⤵
            PID:4856
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:8
            2⤵
              PID:2008
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:1
              2⤵
                PID:2180
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:1
                2⤵
                  PID:2844
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4032 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:1
                  2⤵
                    PID:2528
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4828 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:8
                    2⤵
                      PID:2692
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:8
                      2⤵
                      • Modifies registry class
                      PID:3132
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:8
                      2⤵
                        PID:4576
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:8
                        2⤵
                          PID:2420
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4712 --field-trial-handle=1904,i,10091909755654087157,13804105121962633435,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5092
                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                        1⤵
                          PID:3368

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          456B

                          MD5

                          213c0e5fb6ad6a44adbc297686da817d

                          SHA1

                          f7db202d76d14e08f999a2ffb90705a416eb79ce

                          SHA256

                          0f632a68c4e6481cf07e9253386343a3e13d3fdd35e2d7709c85c5280fe32288

                          SHA512

                          08d5a7ca598716beeff3b3887efdb71a4daf9545fca402d804c8ad994b044494c99f07468ea69e7205c5ab2f611c39eda3c4708d98882bcb8cbc537d572e8af6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_playmods.net_0.indexeddb.leveldb\MANIFEST-000001

                          Filesize

                          23B

                          MD5

                          3fd11ff447c1ee23538dc4d9724427a3

                          SHA1

                          1335e6f71cc4e3cf7025233523b4760f8893e9c9

                          SHA256

                          720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                          SHA512

                          10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          4KB

                          MD5

                          075033655c7c8d566f9d0f9c118cd7a6

                          SHA1

                          321d07f4a1dd63f5106e4fedfa25b939ca86fadb

                          SHA256

                          9e07bf6ec2355f88d87eae68c6154e97d2f06485b92b615e835cad993b762f6a

                          SHA512

                          03acd4c8238b69250396dbea3d1a4531607194673a1322d4881e9a4d1e9318913c300fee4c627fd338403ff320f609030d0e1cc39fac74927e61965d802fa723

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          4KB

                          MD5

                          105bcf544690d75e40e22d187ad8ec69

                          SHA1

                          8e82a5ad19f434ebead434e259e1704e05d15b62

                          SHA256

                          055b47490dbb56f7c77763d0c5b02fd011cb726628400ea41fdae5b5b0f515ac

                          SHA512

                          7e6a34b5ee8472575e40be2e7c633b3c60797c28fa8620c3509516d79ab2ec01456ae2501b11f606b6c0e2b5bfb1c94feef3ece190b8c16b88f12d6ff05df0af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          4KB

                          MD5

                          db0a92026ec008bf9f7c904958a24060

                          SHA1

                          1d74bdca8eaccf77922f2d6eec1b35a6a3904f2d

                          SHA256

                          e8dfdde534cc7f61d56a8956c49b774af7d13d486deba162a03739fe9e3c1dcc

                          SHA512

                          1706ae96f08ebcea2f5817b4e1c5b57ea0cf577bd480ec1dd3df8b7d74c73bf8cb22fd19fbd491ead1308fe637cc79fae89be1ae803c361406fc0d2f3e00cf67

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          691B

                          MD5

                          5cef15ee1b55a56f9f20b5220986a20c

                          SHA1

                          1be6a4fc334b06443d703db639bd15d5c648774b

                          SHA256

                          a308b1fc2de6c07fc1359fed9625cc19f9fea1d501c65b61f019f9852b192e39

                          SHA512

                          994e5b7e7b9e711ba1307612748698916084e031d18a928d9e9475c6b27c3e6efffa37d5411952c4618e47cbb887cd22757e3e9a94cc38406a6de1edb4b76969

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          06aa24b1be0894b9fb37b532e2569cba

                          SHA1

                          327aeaff1ef021edd2f3ab39fcb9c0fe4ebd14af

                          SHA256

                          c9fa100ea0142a5787174616b8ec7d813be2de5912d04c6648f31e2d3fbad707

                          SHA512

                          de62e2531674d0447337e22f4a92ddf820adf0a5f99aeb13ee3817e78604726f8ffe636ec4b234cb20ef35d1ad98c3c68e3e6371381aa56aac421e009ea55ce5

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                          Filesize

                          56B

                          MD5

                          94275bde03760c160b707ba8806ef545

                          SHA1

                          aad8d87b0796de7baca00ab000b2b12a26427859

                          SHA256

                          c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

                          SHA512

                          2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe577455.TMP

                          Filesize

                          120B

                          MD5

                          b1dd5176ed039331d331fcd9843a9e54

                          SHA1

                          832e6d29962a3b012922e4296529cffecd1effe1

                          SHA256

                          a10a7e06cab507664230254d7124da10c5ce3ae823b6c35c6b6b042af58d739c

                          SHA512

                          807a42e707c40cf8412904bf36fe74ac040d10e750faba4954a7c8afbe7854376949cfc0ab1213174cb581ec13ed0bcd4aab4d8530fdf3fd8faeee6a27cb1ed6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          250KB

                          MD5

                          321976b48610892778c358de4bbac533

                          SHA1

                          b4d48d8d84c6f0c867af43846049b1f3de70fd9e

                          SHA256

                          3dae41b104b063560c56fc15f8bf597505543940ac7a4fbcc994ea0f767183e4

                          SHA512

                          72768637ee68c89764d9e3a5e77b07ad113d768170e224bef9a1fe622ec5aa86bb8f8ed527de07c22023998999313c353ff80c3c880b03a55f4082c5ea4e9960