Overview

overview

1

Static

static

1

URLScan

urlscan

1

http://ehtosgroup.com

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 23:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://ehtosgroup.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ehtosgroup.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef993ab58,0x7ffef993ab68,0x7ffef993ab78
      2⤵
        PID:748
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:2
        2⤵
          PID:4884
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:8
          2⤵
            PID:3496
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:8
            2⤵
              PID:3104
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:1
              2⤵
                PID:1636
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:1
                2⤵
                  PID:2328
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4424 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:1
                  2⤵
                    PID:1988
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4172 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:1
                    2⤵
                      PID:1736
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:8
                      2⤵
                        PID:2964
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:8
                        2⤵
                          PID:2704
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4860 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:1
                          2⤵
                            PID:2328
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4612 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:1
                            2⤵
                              PID:3092
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:8
                              2⤵
                                PID:3668
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:8
                                2⤵
                                  PID:5100
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:8
                                  2⤵
                                    PID:1400
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2572 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:1
                                    2⤵
                                      PID:1244
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4844 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:1
                                      2⤵
                                        PID:1844
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4544 --field-trial-handle=1928,i,7897313313581280740,1887981107147250065,131072 /prefetch:2
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3940
                                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                      1⤵
                                        PID:228

                                      Network

                                      MITRE ATT&CK Matrix ATT&CK v13

                                      Initial Access

                                      Execution

                                      Persistence

                                      Privilege Escalation

                                      Defense Evasion

                                      Credential Access

                                      Discovery

                                      Query Registry

                                      1
                                      T1012

                                      System Information Discovery

                                      1
                                      T1082

                                      Lateral Movement

                                      Collection

                                      Exfiltration

                                      Command and Control

                                      Impact

                                      Resource Development

                                      Reconnaissance

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                        Filesize

                                        2B

                                        MD5

                                        d751713988987e9331980363e24189ce

                                        SHA1

                                        97d170e1550eee4afc0af065b78cda302a97674c

                                        SHA256

                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                        SHA512

                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                        Download Submit
                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                        Filesize

                                        7KB

                                        MD5

                                        424f80ccc17501a0d7a1f09dc87298a8

                                        SHA1

                                        96d2c1b94346f7a230c7d7ed4577d26cb7b76214

                                        SHA256

                                        9962c2e069ec9491a632d49d695d0c2d386aaff510184dc01fdf969b18fc5b40

                                        SHA512

                                        cbec730cf033ffd4caa0e4c498b8c68217e89e9c01970f5145f2f4122b9f5900743ba82b3acf97de33e912264fe530750173284cb3d2884aac4db6b3c00719cf

                                        Download Submit
                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                        Filesize

                                        257KB

                                        MD5

                                        621bbc0dc2a78b846f0a05609892b044

                                        SHA1

                                        f85ae2581e70ac5750bc1143ab695330ab998202

                                        SHA256

                                        17ccc61f2c647e0d46e790e2e0290e7d9ec7065fc13244d86fc04645e7abbbd6

                                        SHA512

                                        176beba8dd2135b91d89aed78a2d2dfc62f00473606dfe05e2955088a4f165fc5531e4f9ee7f4b5ecf82b5ac0d61152a9eddab5670adc6d8e63570af9e973118

                                        Download Submit
                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                        Filesize

                                        257KB

                                        MD5

                                        3d78fb0b1b15da6384947758ed161da5

                                        SHA1

                                        fc0a2e24e7db47f50eff5b8089d1bfa57add1452

                                        SHA256

                                        b67aad0b3a243d4b9a5943e3d7e07242ba47bb04ae5a345d7923c8358b00b55f

                                        SHA512

                                        8913eadce70193e3942f324c17cb36e6b63d210070eaef92912b4cbe68c8b494cf1e47d3c7f62d83d17a6fef8134bf3cd16b4243c6218b0de1999665031f2720

                                        Download Submit
                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                        Filesize

                                        257KB

                                        MD5

                                        5d6b27e5cc3fdb0dba06a57dccb0bc12

                                        SHA1

                                        e222fcdad761e47ce4a547267ec27a06097dc092

                                        SHA256

                                        c5c74445eaf9339d87668a0cb8eef3fefc8d0ea0c06ff447767e6a4e3f2ef378

                                        SHA512

                                        b5206dfcd311d99724f27a22807a2807440f856202cad17c6fccbbeb78b7a67b3b3a074aad7d10304ef7694ec1d596200ec12bf1db06ddfb5ba44e5af79c8409

                                        Download Submit
                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                        Filesize

                                        281KB

                                        MD5

                                        a8c50ae6d4989cbfbcdec285ff0a6761

                                        SHA1

                                        ac09be26013486f0e4d7defc2e5604de54b2127f

                                        SHA256

                                        84ecc8e3b8cf42bb6fd742045b2502bf7f7a5ec5210206d0671ccb65f769500a

                                        SHA512

                                        d0f7d3dd37d6bd275da6941b1affc83f06b7849693f582ee34b3366c310f17c761c4f3b3d7dc835049752683c57390dfd39b5af1b70e07aae51fdf553f306342

                                        Download Submit
                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                        Filesize

                                        90KB

                                        MD5

                                        bbc60f5d303efa4c166827aca843c23e

                                        SHA1

                                        6355c72ce40a86edf42ee8dc671ff5bdd66e608d

                                        SHA256

                                        f0ec58a8a946510357d774019dfedf04257b1d8cf54f254c22785c92b749432c

                                        SHA512

                                        a54d89d097d9519e6ac337086c9614474ccc00625e8250ab124bbd60561dd272e8fe7598a6c2c812f7e5929cc764eec80a323bfdecdbdbfc3e64f11f6d77c943

                                        Download Submit
                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57e119.TMP
                                        Filesize

                                        87KB

                                        MD5

                                        9c39b4f7949957c94bcaa76c1257fb36

                                        SHA1

                                        4ad0665c9b056dbf23b1e7ee22d6c32b09476c82

                                        SHA256

                                        571881bb304234711029c0c8186b33e5cfd7f4653ed7c3912c5a99788115995f

                                        SHA512

                                        6a6eeef7e7ff2c86cbe5d10786a3acf3bcdc9726cfdb2da86072be1a4f09ee7761aae616ceede572ced72f72537094188143cf5b1a57c4cabb76b5994769a223

                                        Download Submit
                                      • \??\pipe\crashpad_2024_PURJSLWHTIGMQQQE
                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                        Download Submit