Analysis

  • max time kernel
    90s
  • max time network
    90s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 04:24

General

  • Target

    https://mmg-co.com

Score
6/10

Malware Config

Signatures

  • Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mmg-co.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe410aab58,0x7ffe410aab68,0x7ffe410aab78
      2⤵
        PID:964
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:2
        2⤵
          PID:512
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:8
          2⤵
            PID:4988
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:8
            2⤵
              PID:4916
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:1
              2⤵
                PID:3100
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:1
                2⤵
                  PID:3728
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4328 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:1
                  2⤵
                    PID:2888
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3044 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:8
                    2⤵
                      PID:776
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3260 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:8
                      2⤵
                        PID:4520
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=740 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:1
                        2⤵
                          PID:1492
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1860,i,8018768386049509864,8920986906018300060,131072 /prefetch:8
                          2⤵
                            PID:4300
                        • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                          1⤵
                            PID:4984

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            288B

                            MD5

                            7a219175b1f971c02dacec65c6e396e1

                            SHA1

                            1c4beb26e890e87020c2795cbeb8ef7836d50663

                            SHA256

                            aedc429bb77811239139038267fe0d6ebfa11d5bca0b45b64220e37faf25c076

                            SHA512

                            a4489aade5c4c50006d8c88a4bfb72bda92ca777a7deceddd50e4a876637e52ecfe1ac7804ad19183c66fbd0c4fafdd1ef74322d220b6acd9fcfd86fe392fe8f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            3132146ef31b490666c4f07885a8a6a6

                            SHA1

                            ecc7c0239d03f6aff2fb8d9bfe9aab8ec0c5abb3

                            SHA256

                            52956c6e4f775a399cf388a7d1cdc60110989f96830d39fb4865b425370c8212

                            SHA512

                            325574ef0e839850e1c265fdd325ca777609b48b61d1d33711af19763823c39a8627fc08975f57b27e5dfa6d11b8aa4613c0790fbe4c14c19b0d3f1765c7d2d4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            857B

                            MD5

                            f56a43f0fc845b6458224fcabc556c02

                            SHA1

                            a51f375c255904d6671435f433f05b69d692fb10

                            SHA256

                            31dcd7e87c6918ecd2aa194ec33dc26c62e6abec2ba769b3645e365e41a80405

                            SHA512

                            5282f9f54021768653f0d540b654a91340cfb4d6539562e2f684b2e331083972af2f24fa7e5d3e82a9c88813c441be843686154e9710515681eeae0773c0b058

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            86bca320945fcd00462c81d6aa89293e

                            SHA1

                            d84d950a04e3e3816fc78f54b306a82c3e449d2a

                            SHA256

                            19c8141a8d18b2e5614a255d9fc91d19c63324adfd7527c51a9b30741bfd9ed2

                            SHA512

                            fb0ddfc24696e5dcf2f54e0ba49df4d5a6056a53133aced368d948b945b134742a291859ff7cebd4d585367d33175871d8d52d2ad749fe1a664f7bb644536b64

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            7KB

                            MD5

                            05e94d91c8d0fc98a19bd24b8ee3e51f

                            SHA1

                            6a1cd0949d74f4107a2d75eff938512b4f05be54

                            SHA256

                            94bbd2817d409901c987b6fd9fe05e6b272b7bd671aec798a275c3de7abee717

                            SHA512

                            a99b8e47dde27129434a057340d4212f2f5391a9e53428e6fdfdedf8843ffa910a0cc3d73b6cf4a5cc413ba92d29e55a1645eb2c3de7f07fb00549c50a01d6f1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            7KB

                            MD5

                            73f2b27cb6a90bba5970b0d7089a3678

                            SHA1

                            88b3a9c0aaf7348b4fda990fe452545c51c222cf

                            SHA256

                            8ddf970c798f07fdb801d7ad048e659147ac52c38f92c4a61a9e9ae1eb0ebe41

                            SHA512

                            f223d5dbd8c9f4328fe1db5551f151d72834dd625c8fc3974fcdbeffd5812ef26003b7742e99826a31452252ea780a5ec566beb66775408422e6a5694e5aca35

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            255KB

                            MD5

                            a7131cebef58175a69f0694f83d1ef5d

                            SHA1

                            ab0a707b2f76c4ea289c47d249215b83c813444b

                            SHA256

                            b79d125e26de426fdbd78b5b979c6e4b6497fbc95ec8f2a38f47f21d289a86e4

                            SHA512

                            dedf8d804fd4a8efc7b36b64f34460d87a8af3db7ac5f2b75c2dcb77249f7f92d84ee751279d5df4b0c94dfe7ecf035f30847efb43e510b7b6799854cac2bd3f

                          • \??\pipe\crashpad_3144_AZVOEDKDUIJIMXUO

                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e