Analysis

  • max time kernel
    600s
  • max time network
    600s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 04:44

General

  • Target

    https://cPtGB04.na1.hubspotlinks.com/Ctc/2L*113/cPtGB04/VWZsp228WfM4W375gfd3q1rDwW3kyKQV5dFj23N1PJbts3m2ndW6N1vHY6lZ3kSW5fN6812SvJq7W3mGrdP7VHN1TW3pN0FL4p7lDXW4Xs_GL2lMjmtW3ptX3k4vCMyQW4vJ6pq4DN3XDW9hmhjD4wlxbjW68f5TC5HtqpSW4d5SSX4xXR6YV3WLSY8fmH10W1kDbf52KL1y0W8qhRxs4RCvNxW2xD134196RDgW6ml3Xh6Pwy3YW5gqfdV682XvXW5qHqNX7jt

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cPtGB04.na1.hubspotlinks.com/Ctc/2L*113/cPtGB04/VWZsp228WfM4W375gfd3q1rDwW3kyKQV5dFj23N1PJbts3m2ndW6N1vHY6lZ3kSW5fN6812SvJq7W3mGrdP7VHN1TW3pN0FL4p7lDXW4Xs_GL2lMjmtW3ptX3k4vCMyQW4vJ6pq4DN3XDW9hmhjD4wlxbjW68f5TC5HtqpSW4d5SSX4xXR6YV3WLSY8fmH10W1kDbf52KL1y0W8qhRxs4RCvNxW2xD134196RDgW6ml3Xh6Pwy3YW5gqfdV682XvXW5qHqNX7jt
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaee4a9758,0x7ffaee4a9768,0x7ffaee4a9778
      2⤵
        PID:4344
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:2
        2⤵
          PID:5096
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:8
          2⤵
            PID:2480
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:8
            2⤵
              PID:864
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:1
              2⤵
                PID:1012
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:1
                2⤵
                  PID:4888
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:8
                  2⤵
                    PID:3648
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:8
                    2⤵
                      PID:3448
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2908 --field-trial-handle=1720,i,16837461900774378199,17789532393141753610,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4936
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:3924
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
                      1⤵
                        PID:4520
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
                        1⤵
                          PID:3892

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                569B

                                MD5

                                a0541e197917cebb5de715918f673bcb

                                SHA1

                                45a9f6728f34662cf44040b45f176f0007f76cd4

                                SHA256

                                0808fa46865e6ca0f4d0d563dbe55562f8ee2fb731e1845316d71cfb2bc7eff8

                                SHA512

                                0ccf916cca1c083bade30dea128279d45a6d6e8c3e5e58ae826d8b42c7b7bd96eecad11ef5bb56f3644cc549e768d691b66b394e3e730b0cca751d21e70efd04

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                986B

                                MD5

                                d6b4beecf60f75c8a77094877afb8ca5

                                SHA1

                                e548e36c42e63eb35729a398b12847df8697294d

                                SHA256

                                51992c9b16b7f2e510679ab2d56af3860f6865ca5f7a1354784271176aca2bf1

                                SHA512

                                b8e68b57c0b579987d8825527ee2659d72f176cee478f54d8101265a8bd7d79c9fde383eb604c9faba76f422e6a7499dec0a52d54709fcd6d5c376924eaef753

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                6b4f0a772c9662f298253f98a726ee2c

                                SHA1

                                709bb3c91638d3c70a9a942be0bd2bd6ffddd182

                                SHA256

                                68078a1f122db0a196151fb79d5f0c846dbfe58cc34e20f71d836bb123cc59ee

                                SHA512

                                6864e41401c22156fff09a000fdc0ab2628130461f4d4c8c4558ec493bd69a95734e861dcc2e8f41f8f4db69855167c817a87f2d3d0258dd85317e7e1bd1625c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                705fc0cbca6e9cc615a3e1125b961e17

                                SHA1

                                dddc83eb3be0e8602933134b7aed1d1c9cc533ba

                                SHA256

                                8d184592faf1edce12516e01ad162f3c8d8269dcdc8e847ef4dad2e6f7ee2ec3

                                SHA512

                                8e01ba8181029e3d67b61abf2f0ff336874784a24f4324d4ac62f5beebf4b123c56db65733578d1e1d7e9ef0ae49ebca99d1807cdc503e6489e6a2fc0130b303

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                b18fc587eee6e848e8f980cddbc363d1

                                SHA1

                                0fc5fcfbd66a5c877cd1c01f4038317ac7ba615d

                                SHA256

                                c1212ffc5f4f2c6d4202ed81b90d4e3a6e3aeb342e9b9d52ff9ece37b76c35ae

                                SHA512

                                3932cd31b0609fdb1b76c7321dd974a7ac5c862230490e6765e6649a8f6307a81ff9702373fbe9a233b12c8fcdef6294740ca9d51cd7ad0a5daf16397b981c1a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                128KB

                                MD5

                                7afc1c2014eab48a3903a89e5db1f4d8

                                SHA1

                                8180486fab3b47df7df40a5363681fc7c34d26d9

                                SHA256

                                2a504b8aa9e789ee51a5c471cebd93c3aa82a87d16a1a6da77cb29dfd2fc36e6

                                SHA512

                                5cf20abc041a9490aec128e5ef4c5778e24b0e91dd1322a115c32042395e07bc71f8dc35e37fced09cd9c6ba47b90aa1913903b89531d82a81d4aaa52c372189

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd