Analysis

  • max time kernel
    329s
  • max time network
    320s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-05-2024 01:26

General

  • Target

    https://down2earthincs.us17.list-manage.com/track/click?u=a6722c149df2e70d2e90b77d5&id=0c16d919d5&e=627038960f//#/?//YW5uZS5tYXJ0ZW5zQHZvbHZvLmNvbQ==

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://down2earthincs.us17.list-manage.com/track/click?u=a6722c149df2e70d2e90b77d5&id=0c16d919d5&e=627038960f//#/?//YW5uZS5tYXJ0ZW5zQHZvbHZvLmNvbQ==
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe4abab58,0x7fffe4abab68,0x7fffe4abab78
      2⤵
        PID:4112
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:2
        2⤵
          PID:4900
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:8
          2⤵
            PID:5116
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:8
            2⤵
              PID:4964
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:1
              2⤵
                PID:3784
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:1
                2⤵
                  PID:4904
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4128 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:1
                  2⤵
                    PID:3964
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4432 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:1
                    2⤵
                      PID:4008
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3232 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:1
                      2⤵
                        PID:3012
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3024 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:1
                        2⤵
                          PID:1532
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:8
                          2⤵
                            PID:4640
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:8
                            2⤵
                              PID:1220
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4920 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:1
                              2⤵
                                PID:1744
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4884 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:1
                                2⤵
                                  PID:4584
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4384 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:8
                                  2⤵
                                    PID:4848
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4216 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:8
                                    2⤵
                                      PID:2828
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4408 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:8
                                      2⤵
                                        PID:4376
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 --field-trial-handle=2000,i,13406218090499482306,6582559906180281138,131072 /prefetch:2
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2024
                                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                      1⤵
                                        PID:2080

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        240B

                                        MD5

                                        4bb85030e066286c8995f7722238f7f3

                                        SHA1

                                        7d4d87552b66333d20651f8430fa1aceafcff276

                                        SHA256

                                        d47144de9a9bb9d2b37078f73805cf3396154560bc1dc51590580e161013389d

                                        SHA512

                                        1b0e3d5d09724fdae90984b853bb3619b334f5cae22d291b5b2ebe9bb44bc3bfa142668e1089231b048db264aac54113aa215a462c238fdd09bea2c087d1c6e6

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\13104c5d-ac9a-42bb-9a0a-31b4bc29836c.tmp

                                        Filesize

                                        2B

                                        MD5

                                        d751713988987e9331980363e24189ce

                                        SHA1

                                        97d170e1550eee4afc0af065b78cda302a97674c

                                        SHA256

                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                        SHA512

                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        2KB

                                        MD5

                                        8bd75a3b39e2c5a54960ebf477bf8c48

                                        SHA1

                                        a65f1f5b816e6154f6673d9ccdffb90120b9d4d9

                                        SHA256

                                        bc9e57f01f529cef0042a1219592f2be1f6bba58b15435415c08514fa695964b

                                        SHA512

                                        b4a334d393654463178c1afa274edadd349bb00d94d5e59578991b4186b000ee32ba1493647c877091d38be7a148e1505b425cd2a95223a65b220e239ed0a617

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        2KB

                                        MD5

                                        ecdf8063a76a71ee6e7e88137f9063d7

                                        SHA1

                                        cdce2fcc0dd331f8f1f48662f7be2693689bf3c7

                                        SHA256

                                        74739fc52a07105fa5de10da9d9323c45bacd1c0e721b234e04857f3dc5a3d54

                                        SHA512

                                        7e45c4f1e99c88d7f9aea05a633aefe40c79660278e7e799a8814ab9f63b2d4cdae00245c0bafb7d177d8448236128ecc9cbf1a63fcf10c1194f6f4140595fa2

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        689B

                                        MD5

                                        0ea9ec432159034c3a0b4ee28a811adf

                                        SHA1

                                        af52241033465775a69c3693143a4762d7592dd4

                                        SHA256

                                        17df00616c9e0434e945bc0edbb2d466ece4e44fc6bb5cd21a350568914f6950

                                        SHA512

                                        c8b5a522fac8bb13fd407a5c721c10ec35f0c02d040f3e40af6c660ddb5f2e12140293768e29356fb3d7d6106134652829d900e378319f400e38c82bd7a45313

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        1KB

                                        MD5

                                        818b6b0ef6b6e0394780bdd67a9949cb

                                        SHA1

                                        39d7371962a7bf2b8e9835662389cad3e93bd0a4

                                        SHA256

                                        bc03235f6e8d539820d64b3c617a7b8e837749893de370c7547c92fbcd046c5e

                                        SHA512

                                        6ea0ca5838ade5ed9d742e03e0337472933c1ed8f1890e7f743061e289da517b8ff2e597b49c05b867574261963a3568b5e2cc9343a336a4bed93a69adee5cae

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        7f67fd902edd93e7d58874d5701bfdad

                                        SHA1

                                        7c22622556dc5ed93735d0fbf440b975c486610c

                                        SHA256

                                        c3d1c0d6ffb4011d7653adfa051b9d220b3d98f6a6609572383251de0931dfa5

                                        SHA512

                                        1bc48c6c62e2f5e1ff54d5e155bde013161e4a20fc23a25fd2d56ce5e3fedd2a925090bfbc3bc52fcd84c193d108a8acb061309ca066907c4cbc7d02c849a1df

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        a722fd0cbe440056ea44f1d0319b7d60

                                        SHA1

                                        339cde23315889ce152362c11408b313cc3c4273

                                        SHA256

                                        43f72e65ad8d2feb2d97b32ababf5f02476e9369af26f4bac79e323a726a73c4

                                        SHA512

                                        44c36472df17948f66481935c2ff67050fc4077ef0c2b61374a82a34b43b5069ab88654425fc04e8726181220f6c9d86ddc2a3eb6e0edb95f65426ddced8b2a5

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        131KB

                                        MD5

                                        db2f6c972bc36904d9eb759f7c445d54

                                        SHA1

                                        322e1f022aa31b456aeec52a0a47a17bf1206da4

                                        SHA256

                                        9e146ef2729da771a3d2b65dfd7ac91f2a41016066177a87faaf5ef323116942

                                        SHA512

                                        eb99c638ef3c337d9c067df6a3d724fdca5041e2b7a825cca9b44359a13199f93cd8d10fd13237ca65cdee4bc882d930b52eb914252e8bdad7f7bbc64654c9bc

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        131KB

                                        MD5

                                        9263e350d07574ec74c73b04b7d82e28

                                        SHA1

                                        139465a24be5b380d2b1f8937f609a0a61ab4507

                                        SHA256

                                        bd42e5ded76d6ff9859f54911de87b4d707cac9e326197a5834c94698eb40752

                                        SHA512

                                        bcc7e86094aeffed13f09c9ee6ef325cb61445fd6ca13b027a40ab64d346d93496280783839c98c029ae4c2b8ff731c60dc5f9fef50cb7c2a781d8e597d437b0

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        132KB

                                        MD5

                                        4c7ae47c3ddbcc825971239486df1a0e

                                        SHA1

                                        2a7bdaa0bc40d9466e5866119c97e2364537cb62

                                        SHA256

                                        2f11cda2dfcf87de05be5862c82f3a20a289317cd2a55f602b6ca93dff776182

                                        SHA512

                                        0f45affd40ea629f66ed5e5139844e19671614396d20dab3bbc0d55a15903dc20a7bc5bfe227ba6f153cb6536f1f6b3017f75dc6ca4480cdb1303c1c20c6aa72

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        152KB

                                        MD5

                                        f76df90dec36fc4a3cbacfbe345d3c37

                                        SHA1

                                        20e81341a0e708f6c39c9e5218a1e427dc0c2d55

                                        SHA256

                                        fc1004349cb692e71728789d7f6a9383cc12d84f5b3412a61c07751c8a391115

                                        SHA512

                                        4a3168970ea55de59855eaf6d054788d5c81c731277b59823b447afab29f9cd70b81a02124ed05f4d357a98d4cfe4a101e6e454f81199cb40cba833c43ce66fe

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                        Filesize

                                        94KB

                                        MD5

                                        d4a7c8235d7e406f1448518e91886cba

                                        SHA1

                                        27cfbd58019d0415b52469811e2fd3a84adbe160

                                        SHA256

                                        92a1ed89ea9c6036427180c86bcddc05a97058eeb2472a8e81a68e5e2fe1d1b6

                                        SHA512

                                        1293cd42f54fff502a166a48e8524914bee222d594c0b737787e2dbad3f3dcd6a5f2ea3d9cf027b200abdff967c8825575f4e4a2c5ff555d86971011debee2a6

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d755.TMP

                                        Filesize

                                        91KB

                                        MD5

                                        e88a14e597d18e10773798d46bd59c93

                                        SHA1

                                        22fd127a03c1a2ee8d8e2a16edd7c965c7bcc4aa

                                        SHA256

                                        7461351a552a2b87dd229d6becae2ad021bcfbbbe928fc01e67d615c67c6d137

                                        SHA512

                                        07400d470d369645582d7f1a399c97c26aa5929e5d692be5c13f13b2ba42b83869f2feb6f45ce27f5fc0c1f4b90ac5c33ca474669af840f9ee3c72c0815a2d87