Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 03:27

General

  • Target

    http://click.mail.virtualtrainings.co/?qs=4a0b46b9cf9a1c36377376564e74a2faa8c195c0dfe2c56bbb9cc072e44ff6a3c2508474909b5775cad2ded3fe1c101afec44561f693dc6db230c5606f7eb70a

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://click.mail.virtualtrainings.co/?qs=4a0b46b9cf9a1c36377376564e74a2faa8c195c0dfe2c56bbb9cc072e44ff6a3c2508474909b5775cad2ded3fe1c101afec44561f693dc6db230c5606f7eb70a
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0ab9ab58,0x7fff0ab9ab68,0x7fff0ab9ab78
      2⤵
        PID:1564
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:2
        2⤵
          PID:4568
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:8
          2⤵
            PID:3364
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:8
            2⤵
              PID:2260
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:1
              2⤵
                PID:60
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:1
                2⤵
                  PID:2144
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4252 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:1
                  2⤵
                    PID:3640
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:8
                    2⤵
                      PID:3708
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:8
                      2⤵
                        PID:2840
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2760 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:8
                        2⤵
                        • Modifies registry class
                        PID:4356
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2524 --field-trial-handle=1904,i,14183333975526556355,4426199297906905303,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1656
                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                      1⤵
                        PID:1548

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7b4ba2fb-7427-45e6-bd14-af71f97c7c5f.tmp

                        Filesize

                        6KB

                        MD5

                        1055ce3da10ac2de80d3be4767cb516a

                        SHA1

                        207bd9da62a7d5dce25fc48bd93f54276d62a62d

                        SHA256

                        a1ae1e2b51237ee9995505f00d213d2b247fda3e934abea88e3403b233eedb9a

                        SHA512

                        2c80405350f99a9f56854a725636f8d23ad1adb9fbffbc3f95567a5bd3b6e05d5cf8464afef9255d448c6fa6a0b1e993d4346bd6fae863b71cd0f07494e626c3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        528B

                        MD5

                        012afb986a2920611d85185f977f9a03

                        SHA1

                        dc066762d990bf5ec2e7fd3363fb91d98cc62e7b

                        SHA256

                        623e8f6c9e7b5981be59a4bf0037a6517217f8155f99b09d23c4035afe441b7f

                        SHA512

                        2c54d29cb11e1538e8f6d31a65b814668e3f4fdc071c8d114fedbb709628cc5d960069555ddb836ea6ea9e2b311b9db2011ab617fb123d8fe29dfb97024a2a32

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        073e5bfddca03ee84acc507fd772be9c

                        SHA1

                        7713a5f663cf810904ded7e782c65702770cb49a

                        SHA256

                        dacf64e3bf41de663b72f78430b57a43f61b0560eed3206b1248ca14e0a17d6a

                        SHA512

                        3505961b9db6ed0b60a9a88a90f1bfb440ab25512492192c2b73f9d3ba9ff8b3725c607e6c29f211de16e15369600b4d1af1174d237a84917b3b9d19bb339647

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        851B

                        MD5

                        42b892a91e099a4f15351a6cd9affec5

                        SHA1

                        ac92552b940dd1d2bd1ff241c6d6920d2a4ce899

                        SHA256

                        f4b2f0b71f22d32a4ce74d0eb9e947baf531441612c8a761e813f4fe02a58b1e

                        SHA512

                        2f3510672ed649b48bdd7d216f140b699a4df5a03bb1cf8c1af1ef9a0aa29aa8ca27225f5aff4def0dd64624a887bcc0ca339d9f36c43c0cb7a66a82a7995b1e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        255KB

                        MD5

                        7c4429f10f0a11eb427c16675774dc6d

                        SHA1

                        524aa2c91fa71352a9909785d38e4b83233a3610

                        SHA256

                        67eef1fb9879be4743e86420bec4955c3206cd5408ae1de464cd4da97d632c44

                        SHA512

                        ce8cb686494e517c84e3bd316567392fa65bf440e459780959a2f24a1b101026758c4b689b912f4ef404db1c68dbd39aa708a78dec003d623a2adeb4e1b35053

                      • \??\pipe\crashpad_1796_THNMJLHCXKIQLUWJ

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e