Analysis

  • max time kernel
    54s
  • max time network
    55s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 12:05

General

  • Target

    MacroRec.zip

  • Size

    45.3MB

  • MD5

    8323050f437b9d8606f9762147232644

  • SHA1

    330283f39f515ed9360330627a7dd4a24f2dde66

  • SHA256

    6000f0b0b91f12aae6e4250c79b1a682b50fd0236dcfba9b4157f34c205dc192

  • SHA512

    18807a0c74d026fb4fcb19723f7604da8b0ca1faea39a25b94bcdd37282bff1484a2a782ede0770f6fb107817800a12ddb4b84e5f131e209563c8ebfd2b3fe47

  • SSDEEP

    786432:xW9YuYz6mivrEs9MgOh0uoxHH2hJQsQxIKEKl/pITrgkNaCd+gawivwt9p7TTu:mWivr79rsEx2fU+Knl/wrgkNax5+ny

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MacroRec.zip
    1⤵
      PID:1684
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee96aab58,0x7ffee96aab68,0x7ffee96aab78
        2⤵
          PID:3956
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:2
          2⤵
            PID:3700
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:8
            2⤵
              PID:2684
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:8
              2⤵
                PID:4184
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:1
                2⤵
                  PID:1428
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:1
                  2⤵
                    PID:5004
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4328 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:1
                    2⤵
                      PID:4972
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4472 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:8
                      2⤵
                        PID:4664
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4284 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:8
                        2⤵
                          PID:3640
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:8
                          2⤵
                            PID:4568
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4788 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:8
                            2⤵
                              PID:2996
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:8
                              2⤵
                                PID:4640
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:8
                                2⤵
                                  PID:116
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:8
                                  2⤵
                                    PID:2180
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:8
                                    2⤵
                                      PID:3320
                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                    1⤵
                                      PID:1968
                                    • C:\Windows\System32\rundll32.exe
                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                      1⤵
                                        PID:3212

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                              Filesize

                                              2B

                                              MD5

                                              d751713988987e9331980363e24189ce

                                              SHA1

                                              97d170e1550eee4afc0af065b78cda302a97674c

                                              SHA256

                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                              SHA512

                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              356B

                                              MD5

                                              f47258a53c4c848bc97e65b5879cbe05

                                              SHA1

                                              d47d1ae51f91ef98a26ffcb545283d1eab015277

                                              SHA256

                                              81bd28b5284fafafbc4914e55790ee2531332c23b66c4c64702e795f09870867

                                              SHA512

                                              afbb06e9779be04cee04b78c4fa58beb453b55cad6582895c0005437bd7e5f1fc23aff8da4151a03d6061b6d7906fcecaf65f3396ff3f840bd590002d2b08a3d

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              126c189834fd9e5d5e49789417368d33

                                              SHA1

                                              bda5ad07a1c245c6e25ac4b04d4cd460b42b6ecc

                                              SHA256

                                              f6831d643b4886786382e563720d87c2b0481de87097e553bbd71a939d1bb4f1

                                              SHA512

                                              2f11d0aba53c1102e2b7b2d772a1e6bc7b77d17ac138c2a177805ce48e3f2dad5b01361d97bd5b8749550e2c377bb96e6c22360c5c6ed8edb84d936a805973d2

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                              Filesize

                                              16KB

                                              MD5

                                              48914f0e029fe9acdf3969c17100a9ab

                                              SHA1

                                              c0c41a0b4a6ae501295ffc227c25c05b64915640

                                              SHA256

                                              b7dbbc060edb08921197a679b84e6ccffaadebcbb280b1e70b3175b3da18be7a

                                              SHA512

                                              adeb29e150568e2d44ef2451059257fbd659dcabc00bf790d148f94aba4dfe90158814ce751b4a232433c679dbee00e316459b22fcc7ed2dde9ab1043edb407a

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              257KB

                                              MD5

                                              0b97f9091d7f65994ef33e6ddcf27688

                                              SHA1

                                              6d1038409ecdc8bb9b3e9eb51f6e253c466d122d

                                              SHA256

                                              26dc5d4c4272318614b7ef84bb7865f2162ce3a6e9891733e9c37107ee1ecb03

                                              SHA512

                                              134ef814d11c7d20f6779d27e958d7057b9e7e4424fb4e3171de7b95346972719757adde35cf1173c8b8fe0d30e36d32df5271cb93a31c296f05d7fe5ebb8db1

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              262KB

                                              MD5

                                              ccf4da3b402271c03760db93e8846dbe

                                              SHA1

                                              55fd099fda1446f8ee9bed16e3847a3b625f4e11

                                              SHA256

                                              6ee1e4af9d4912e47363a7d4f385d49a662b4fdd03875bae3aeec6c0e98fc057

                                              SHA512

                                              82afafeb97c8f20ad3b1f582786383597d046ab48891cedd41d083377208d577e971368b6fd9e894de93c9244854b6a38573b9763173b70280d425a18d221c62

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                              Filesize

                                              91KB

                                              MD5

                                              906627f0cc49e8b2b562ae0be0912d54

                                              SHA1

                                              fb94e69145434b0710b7e73acaef89473e894b24

                                              SHA256

                                              8a507ec444c8221c73843467ba5c4d533add4c83c8f9ee804ba1e696cc0ad46f

                                              SHA512

                                              fe9a612eb5e398e98c2f540e4eb0ee59f9093641a2604fe876f3c226f1e364b662223554a08e110fb0858f3ea19e05019dbfdf7756b2ebf2215cc783963ae79c

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57f388.TMP

                                              Filesize

                                              88KB

                                              MD5

                                              98d5966b0682ae4b70c0c64be04325da

                                              SHA1

                                              7ac3c2104fe52b81ea3ef68e37d3ae51e91906d6

                                              SHA256

                                              315534ce0f2089dbdfde918062298a0ef47f6347606af4f42aa94a0043d2d44f

                                              SHA512

                                              2ef3a752dae715dca96278f6f969c15cd31a65dea8eba9b3819963f2b5bd12c6ca28e33864d4828ad3207c1f98479c0b26fdc4ab5c5891e7e26faa766623f238