Resubmissions

14-05-2024 01:41

240514-b4dp8seg23 1

14-05-2024 01:41

240514-b35gkaea8t 4

14-05-2024 01:40

240514-b3hb2aef42 1

Analysis

  • max time kernel
    1799s
  • max time network
    1685s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-05-2024 01:41

General

  • Target

    https://google.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe01eaab58,0x7ffe01eaab68,0x7ffe01eaab78
      2⤵
        PID:4540
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:2
        2⤵
          PID:3876
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:8
          2⤵
            PID:4128
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:8
            2⤵
              PID:1892
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1848 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:1
              2⤵
                PID:2108
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:1
                2⤵
                  PID:2064
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4228 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:1
                  2⤵
                    PID:3564
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4376 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:8
                    2⤵
                      PID:4828
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3196 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:8
                      2⤵
                        PID:2472
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 --field-trial-handle=1928,i,14238386991011740609,10752663942559629073,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1080
                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                      1⤵
                        PID:4680

                      Network

                      MITRE ATT&CK Matrix ATT&CK v13

                      Discovery

                      Query Registry

                      1
                      T1012

                      System Information Discovery

                      1
                      T1082

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                        Filesize

                        216B

                        MD5

                        8153ece92397a5ffdcdddb3cbb1e4ef7

                        SHA1

                        c68e008cceeca293e62dd1cc1cef65a0c0954176

                        SHA256

                        38b6ffe83aa843286751d22ba757fefb3269cac07105afd18c2156b36c275536

                        SHA512

                        f7a708871b2a4934bfeae5edadca44abd66d699c7450fcd9f54613a9a4991424ae4b49a458eb407992a55d1d76b4a9e726eecd4eeb4a33686a9806f6bd5d6545

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                        Filesize

                        2KB

                        MD5

                        81dc45aebf9a50ea55f1c12ce36f158b

                        SHA1

                        e99d07f97786a2a3eef19b9c1f3a07d89b63bf93

                        SHA256

                        c40ab0a1d94c08c3c2262c12dff5b3298ab974d4441703c878931a88533dd06d

                        SHA512

                        e9a5257a05d37f9f01eaed68b40dff148529dc59e2fc304e4e5b300211d4889342b4b0502699e4a0d788ccb4a451cf79c16dd8505cea122307efa89a80eaf5a4

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                        Filesize

                        2KB

                        MD5

                        b52a720f2175b8049a828d6acd0099de

                        SHA1

                        92fdc6477e791922f09c6922262f6b16d2caaaa1

                        SHA256

                        c894c80e0a8597697e5879e72321ea14d63a14f2aa62b33ef91cda065689e791

                        SHA512

                        3ebfdd9de18b1917707ecbe49d8d4b0814d81e0892cd0e62c626ab5eb038dd247da41324796f581651af608cc7fd926416389109824672c4317761c37536d157

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                        Filesize

                        2KB

                        MD5

                        fccbc827accc18dc99efc729945f8a98

                        SHA1

                        82592e4a2213c16c450b96b97729d71b852438e3

                        SHA256

                        29e5fb200598c8c553b83a4f71425eeca12f086da8481a381cafcb0cf5bde906

                        SHA512

                        eff5147db6bca298ae1bc511f1073edb36297725defaf91fca105275513c9989384798b43124277f7093899d21ff9e86b1c7e5c784d62cb3f3c27723f2fa3109

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                        Filesize

                        356B

                        MD5

                        97a03fabde8b8bd83a35010341b5b2cb

                        SHA1

                        8c2ac2f29d28aa57f2f89ca099b5ab8ff685a14a

                        SHA256

                        db058c9f5b0b236dd92face7390c90309f89f33a80bed94070a024fdf379ecc2

                        SHA512

                        1c7f23f0b1858c1750597d54634fde93d14a2023bcc34b6974de8f1e3d6f64e639617c2af7b6603e2c58a68a8e61a8ea5635a28c8cbcaad31f42ede3d1ed7ece

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                        Filesize

                        7KB

                        MD5

                        aa8d26c49452f3f5603c370c99aea600

                        SHA1

                        7ad4a7a6a47ca2f53b39443340adb2219df938e2

                        SHA256

                        631391953ae23848a116bc09c7eb7986e542e737b18b18905efdc207c015783a

                        SHA512

                        0f6a9330e4ce35bf9286b463993f991b781888ffdc703647d20f769179de7ca7a6cfc1818f12d6aacdaf2e0ff9e365cdb3bd13fb0f90e79bc2521e293eaa0a49

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                        Filesize

                        256KB

                        MD5

                        3061d914d42e3cc9f37712ec19cb1abf

                        SHA1

                        f94ca22676b72d0dc6a8b74e8cc3520d4e117a8f

                        SHA256

                        9882c6582ab787f4aee170b6a550a96284f4339ffcfb4f00c574745c57b8a7f0

                        SHA512

                        c8353ee2348f0fe770d646ce0098ae486cc24b270a30c0166b2176ec8bad291bed38bcfef5ea7368d28637b8e021bd0d77a498e692fc43d357d73e17fd8b84b3

                      • \??\pipe\crashpad_4748_JACTKPVJSZVNHAMX
                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e