Analysis

  • max time kernel
    1798s
  • max time network
    1687s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/05/2024, 23:30

General

  • Target

    $PLUGINSDIR/app/index.html

  • Size

    20KB

  • MD5

    6d8c9edde0ce101ce0abd73be45c684a

  • SHA1

    ce6d94d2d1a7f4761438781affd3aa991018e4f5

  • SHA256

    f15c54f4ac4f55bcfa281b668220eb144e63b9de2292e970095a4dc566209682

  • SHA512

    06f35ece48e4e19174da18ecc5dcac3a7e4d7ffbb102c4859221c7c569027ca72e40c9ed945872bf4396bc02ced7ae46655c88e3ec40d0a2f2e3bd0fcec80203

  • SSDEEP

    192:DgNbdqnDNlPkZHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ1Hab4OJgJnc5w/93gb:ENMO3aMOUnbCky05SN1

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1296
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd42d39758,0x7ffd42d39768,0x7ffd42d39778
      2⤵
        PID:3016
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1760,i,13648404179616256306,6717637145039728364,131072 /prefetch:2
        2⤵
          PID:2008
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1760,i,13648404179616256306,6717637145039728364,131072 /prefetch:8
          2⤵
            PID:5068
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1760,i,13648404179616256306,6717637145039728364,131072 /prefetch:8
            2⤵
              PID:5016
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2844 --field-trial-handle=1760,i,13648404179616256306,6717637145039728364,131072 /prefetch:1
              2⤵
                PID:5000
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2852 --field-trial-handle=1760,i,13648404179616256306,6717637145039728364,131072 /prefetch:1
                2⤵
                  PID:836
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1760,i,13648404179616256306,6717637145039728364,131072 /prefetch:8
                  2⤵
                    PID:1900
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1760,i,13648404179616256306,6717637145039728364,131072 /prefetch:8
                    2⤵
                      PID:1516
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 --field-trial-handle=1760,i,13648404179616256306,6717637145039728364,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3444
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:4956

                    Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            680B

                            MD5

                            04d13452024bcf1ca82d27a973656899

                            SHA1

                            3541135755febd5d8a20d6f0438c488f57c55baa

                            SHA256

                            0f238702df465c283d289ce647318dd40c3caf3862ebcb19131b235a5d627611

                            SHA512

                            f2202d3def080bfc2bea9c663e9ba5da1e03d67bedf4425ea8bc5f1c4bd326964936126957b4da29df03ea8dab72ff7944e8f232678fc8b0c4e2e33886d90152

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            535B

                            MD5

                            ae92eb228b8c50ea1dc7db4e77249f46

                            SHA1

                            9a402a75cdfaa72c16c6824925deb25b6eb560d2

                            SHA256

                            c4a47502d45e9191246fd79d11b920e531a593e8b223c5b066d256d9aaa0ec41

                            SHA512

                            ca9517573a56adf70a4244ca711732077badaeff059e564eb6efdb9cfa93e821593eb490a746424375e80cc0092de964be2544dfe80e8e96726824610205a89b

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            e07a9ba9c8dc4abd1a7d3fce6abd7001

                            SHA1

                            68c3b898bf4babc559036e0765fcd8010afba574

                            SHA256

                            5b12c512a8928328fb25a983e96b04becddbdc3dabebf1b3d9d1e7b344ce48f3

                            SHA512

                            8acc745390e2ba749a6fa6c2ade4757186ebbfb47be0c711d97cee6746c099d95973bcdb7ce187f5e877eb783d32f3b152e566f5c390dbe2ca9921b1deea7186

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            5b9649b3e324db8a74fab0939a575df5

                            SHA1

                            ade391d2b5bf0f62a8fdf5105324f94768dd9325

                            SHA256

                            46afa6597c10780b2cd08fbc80cf77e2cdf90e1ee3c925eab1984800356b4aff

                            SHA512

                            9b7da5d610512c6abc7083c589b2c7d2db01efe51cd9b44469a851e3755e665b4ab6fc1c861dfc1c3250d297b451187db5a3bdf8e27bb2c130b2e71edea1271c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            3591490cddb7ca80d4f1b073bdcd2422

                            SHA1

                            82980892b13b0e3ce91bc247e4471ffe9216287e

                            SHA256

                            47825cb51eddd8e6150d40bcaccdc4edde293bc20c565a3eeda58aa9e20fe126

                            SHA512

                            c37595dd5ea689be340509686b3f705bfc0b43e248f7077cc17b2578e22321e7603b37138179f9e7f5a7f3588be9c42e7259761367c0d2e0bc5ebab463a87d34

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            136KB

                            MD5

                            1040a3d412e3eb42b7fc05bf06b486c5

                            SHA1

                            83e1a6e56895d53069d4837841aa8575be2fa924

                            SHA256

                            8a35307ca2017b7986d12cde0db565facfda730753dbc13b7c946c1a165e2649

                            SHA512

                            30fc3932838dfbb107d864a7beb54b8fd8567d3770180769e5d65500282b3199306a27f2b6cc9bac74f479b38590061057d4018aaf5c53bc1869a2ceeacb0768

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd