Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-04-2024 10:05

General

  • Target

    http://mindmafia.io

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mindmafia.io
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc824eab58,0x7ffc824eab68,0x7ffc824eab78
      2⤵
        PID:1604
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1892,i,4710585998224126533,12078139468468832346,131072 /prefetch:2
        2⤵
          PID:5092
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1892,i,4710585998224126533,12078139468468832346,131072 /prefetch:8
          2⤵
            PID:1128
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2172 --field-trial-handle=1892,i,4710585998224126533,12078139468468832346,131072 /prefetch:8
            2⤵
              PID:960
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1892,i,4710585998224126533,12078139468468832346,131072 /prefetch:1
              2⤵
                PID:3508
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1892,i,4710585998224126533,12078139468468832346,131072 /prefetch:1
                2⤵
                  PID:2776
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 --field-trial-handle=1892,i,4710585998224126533,12078139468468832346,131072 /prefetch:8
                  2⤵
                    PID:2060
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=1892,i,4710585998224126533,12078139468468832346,131072 /prefetch:8
                    2⤵
                      PID:2464
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3864 --field-trial-handle=1892,i,4710585998224126533,12078139468468832346,131072 /prefetch:8
                      2⤵
                        PID:4636
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2784 --field-trial-handle=1892,i,4710585998224126533,12078139468468832346,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4844
                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                      1⤵
                        PID:3896
                      • C:\Windows\system32\AUDIODG.EXE
                        C:\Windows\system32\AUDIODG.EXE 0x31c 0x320
                        1⤵
                          PID:4240

                        Network

                        MITRE ATT&CK Matrix ATT&CK v13

                        Discovery

                        Query Registry

                        1
                        T1012

                        System Information Discovery

                        1
                        T1082

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                          Filesize

                          168B

                          MD5

                          26bf6c1994c50d44ffc8afbd242b6b1b

                          SHA1

                          3e1b4c02143c1e5bdd907259637c68a7033030bb

                          SHA256

                          cbd6662cdc8d6f9f61f0fddfecc4523d52e517dcf9359f9686f40d9e81b53780

                          SHA512

                          eeaff009c50725d25e4f9e331c9dc34b3a82b9c6db1ae75bc54dfd9c24c5f0f23556163b7ef800b35df9e8a1ae0883453d8065d630bd16b5f84081ee79b12d21

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                          Filesize

                          7KB

                          MD5

                          c1d43df317c71e887ab004b1413c3bad

                          SHA1

                          4d0db08790bba560316117f452e41ab83c7c2f5b

                          SHA256

                          f0a86e8157c5a16f5806d9b674514728b98989de2e9fbef4502d7c1379578ad2

                          SHA512

                          3d39db287897f3b342df3e06a5f3a5312a654edfed11aef53762cfca7b20c108112b0cfb004e9939cd3c114e180bfd6023e7ca0959cf39ca19765a52a1e2a95a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                          Filesize

                          7KB

                          MD5

                          d9b6950fdf4c3832a8807741bcabb2b8

                          SHA1

                          449631ae360322cd2755485066cac5e4827ec026

                          SHA256

                          aefe95d75e50587ba4457c7700f4b05ee8463f38c0d5d2635f20da15b2e07a1c

                          SHA512

                          6a1c94b0e11814d9375cef6393af8ab47106ff7ab4a7ac7751430d65bd6bf795f90a7f203b3c3b8159aaf1c542051649519f7a4e8ae68daedea287f13ab43454

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                          Filesize

                          6KB

                          MD5

                          7f85c606e1c546e5b057281daa7993a9

                          SHA1

                          2bb23f7cf1bbdfbf0a834ddcf8b4243a8562ee5b

                          SHA256

                          1d32dbf538e77655dd72231c6a4e8385eb9e47caa922b25955c203d74d57a6ae

                          SHA512

                          a2adab4390207a75f5fe3d848082312177ee99aadfa26e69f9e6419408ebfe1a1973a7fe6c01e822e958604224b4e4a1b913b3f145e7d77aaf6ff00ea3460a82

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                          Filesize

                          127KB

                          MD5

                          fcd8d62a498f65054fcabbdfba2e057d

                          SHA1

                          95a05209128aaec119a6cf666525a7d0f59b9ffe

                          SHA256

                          d229bcc8169abb72f994fd95805dbf955b27abea9b99926f847567ce1ffee518

                          SHA512

                          181ba6e5bce12bfacb802b460eff6e79a7bfbb669aac6c164043259a46652dfe7b538f9315e881bea723e2777337e234c1ee32db01604d8fb61266361cc05f50

                        • \??\pipe\crashpad_908_ENGNKKPWMQPQEQZH
                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e