Analysis

  • max time kernel
    54s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 14:47

General

  • Target

    https://url12.mailanyone.net/scanner?m=1s9N28-0000qa-3G&d=4%7Cmail%2F90%2F1716288000%2F1s9N28-0000qa-3G%7Cin12d%7C57e1b682%7C11949542%7C14589158%7C664C7BD820EF00EA9CDA64C5861AF4A9&o=%2Fphth%3A%2Fctsroreseatmh%2Fmoc.&s=xD-G9sAzAP-Zf09cXzQztPkgBQ8

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://url12.mailanyone.net/scanner?m=1s9N28-0000qa-3G&d=4%7Cmail%2F90%2F1716288000%2F1s9N28-0000qa-3G%7Cin12d%7C57e1b682%7C11949542%7C14589158%7C664C7BD820EF00EA9CDA64C5861AF4A9&o=%2Fphth%3A%2Fctsroreseatmh%2Fmoc.&s=xD-G9sAzAP-Zf09cXzQztPkgBQ8
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcca3cab58,0x7ffcca3cab68,0x7ffcca3cab78
      2⤵
        PID:1396
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:2
        2⤵
          PID:2244
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:8
          2⤵
            PID:2580
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:8
            2⤵
              PID:4324
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:1
              2⤵
                PID:2404
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:1
                2⤵
                  PID:4740
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:8
                  2⤵
                    PID:2688
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:8
                    2⤵
                      PID:4428
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4548 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:1
                      2⤵
                        PID:4408
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:8
                        2⤵
                          PID:1708
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4052 --field-trial-handle=1972,i,1460974056413212924,1175518614583951700,131072 /prefetch:1
                          2⤵
                            PID:2000
                        • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                          1⤵
                            PID:3616

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            240B

                            MD5

                            039007b92b2ca9f71f76e1ef3d9c762e

                            SHA1

                            b00258a6d2f749cd16b6db105b37dec71cefc8a5

                            SHA256

                            3921ed15c43536fc73458b867fee9ee39a70b95dc2e6d4590fec37ccff436ec8

                            SHA512

                            eae7fb8aae8f407123e28487be9f8403371f770bb1affebb2d6dea26c9ff0549859ee59eeda97af44890dac11140a6be3eeea6bfd1d4b2bb797169971420d2c7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            524B

                            MD5

                            9f2b744a7cce6a6a0c4431370f661412

                            SHA1

                            a73ec89ce12ddbc2e88c208551d28ec6988c8d2f

                            SHA256

                            dc18e0feb5f7d5fda13b13959569056c58d0b9c530248cbbba02ab776943823a

                            SHA512

                            d2465541364a60e137f8f09140e09ad5edbbba5b7b54d42a321512c6bc6e589a27661f2f79ab628c1a6b12b1260b5de0e5116a59c4592417bc5a978af31caffa

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            7KB

                            MD5

                            26cdb29bcaf09d1afcea0e3a7e1c0705

                            SHA1

                            a1b6b4152695e10b0f752efe6ccf1a5a4b2de978

                            SHA256

                            55acd8cc3446b5fc47c7e255b2e76fd545c742b0016d1e35e741bb15122ef7c4

                            SHA512

                            590d967fc0c02ff2e61f2d1884acf32ca4cffe1fb8cb2fb5cb38ccb8cab10ca3b33a067ee0604c4952c8e0aef9897f63dafc6b0c16fd4354fc8c8b1622c4cbd0

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            7KB

                            MD5

                            2465701acf2312b1abd2d44cac4d5875

                            SHA1

                            4195dba8aa5325775a9861e8437beceb0a161d04

                            SHA256

                            353fed9e16b83773f5d21ad7d57d6e708c269f0bb2591bdd3e5e17887e387d47

                            SHA512

                            ec516c747edd91683294901219f4335168bdf004e92ce0ec040ee4e5cc99a2ad9b595f92bbc632717fb9050d440c2643b773b6d06506b312f4a634a322aedf20

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            129KB

                            MD5

                            cb93ccc18548fa7a51cba56ca25879f4

                            SHA1

                            6c7fa57989c546c30d91555c3878c755c96657ea

                            SHA256

                            ecb4364cccc80fb5e10e1631d1545c50e0025fd66765ba613c4ebf039a1a386d

                            SHA512

                            2ccc4f4ec400fa45acd4b37de6daba8b2bcc95c26072f80491c87df0a6b5ebecf39c1c463be4a0dd31793282574e30d784ed2fc9224ad42f4f8594b5339a309d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                            Filesize

                            91KB

                            MD5

                            b4d14474461e30e2d581f860585d89fa

                            SHA1

                            76d724caf4df8d78b96ac734e09f1f64cba1b947

                            SHA256

                            6fd2f6eed4c6a6f544a666659b49c169c11782bca2505681355839ef0e9e5330

                            SHA512

                            8973bbc9662d60430ef7ddbeb33f8fa80482497e3868a045b258db80741ed6a58c1d773a9b941cb86f5b58bc3498b4ffb4b604b296ac1c220376b6fcfe60c680

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57b1bc.TMP

                            Filesize

                            88KB

                            MD5

                            e84909f20b16367b28e3d8eed407896a

                            SHA1

                            519ed25707cfc67560af24a002e750fa69c8090c

                            SHA256

                            172080e0a6b96ea3512e47315e1971f83c18cb548bce99a637d1cff237f25dfb

                            SHA512

                            278dd2347b6abe024db5dc3be96f30cf479aa2cc55c4701e0bb1118f935d61cafa8a13d371e66884891498bb14929ade879feca437af97ae4f2d4b654df7dec0