Analysis

  • max time kernel
    299s
  • max time network
    298s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29-05-2024 13:33

General

  • Target

    http://payeecentral.amazon.com/Invoices

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand amazon.
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://payeecentral.amazon.com/Invoices
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3296
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe2d509758,0x7ffe2d509768,0x7ffe2d509778
      2⤵
        PID:1116
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:2
        2⤵
          PID:1360
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:8
          2⤵
            PID:2008
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2040 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:8
            2⤵
              PID:4384
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2600 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:1
              2⤵
                PID:3696
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2608 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:1
                2⤵
                  PID:952
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4440 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:1
                  2⤵
                    PID:4168
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:8
                    2⤵
                      PID:3528
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:8
                      2⤵
                        PID:2544
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:8
                        2⤵
                          PID:4404
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5096 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:1
                          2⤵
                            PID:1408
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5348 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1272
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:1380

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            744B

                            MD5

                            2e9ec82f4351cb56968597978521667e

                            SHA1

                            a3573a57f93cc26122b30e111cf12617e86c605f

                            SHA256

                            8bcc86a6df5b1f8c8e88320f1b1e64837e9830a0c108f0bdfcaa0bb4586a4a6e

                            SHA512

                            ae319d084c652c7bcc5ce270a33b6939d49b20ee88c307cffabd365f45392fb662684249ff5b884d836ef59ae6acaf8f07186a65ac79c1a462cd37b94e2e2cc3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            5KB

                            MD5

                            fe3f8f5d92a7d08771365009384389ee

                            SHA1

                            348655153f748d9bc1b6dd0f3e875eef80a6917a

                            SHA256

                            9b800009163ff9bf3a388fbf61d1359c340e435c82c3a993613bb0237715a05c

                            SHA512

                            3178c6870d8836a17ec8fec3bd6c9f8dadec0592226732cc9ea0d6cbb8298306360dcdd0512f7dc053ad8905421fd7842365c368476e323d96134bb3fdeb787b

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            5KB

                            MD5

                            d4aac83192823778a83431f72d0e4804

                            SHA1

                            d8fdb534d7c5cb6cc4061aff96ddffd51bfb7e8c

                            SHA256

                            8414fa892cc679a994253d3d359cc674a144de902f7b59ef10db106a857e0b78

                            SHA512

                            796616cf1959405db3fc1b3477149f0c1e73fa2d664393272efa6f2b0823514fb8f373ad9282c716694a4d072e6b300dc0b3bfe9f2255367313df2e2bf73ec38

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            2KB

                            MD5

                            178df80582178bc2b5a8ec22c8f95131

                            SHA1

                            9670a7fc3add5875b236b89cffc317a551c899be

                            SHA256

                            ee799db489cc35f5ff8c56d2e7f22ebf0d475521888bb0f9fd319c0c790253f6

                            SHA512

                            69323c4d33da629081f7efe7279a1efce0bde53382e65178407710d548094040bc9a2236c46ef21d2ed0a71b954f9b09160f7d1af1a803fb66d470b9879d1c46

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            2KB

                            MD5

                            1f393234eccee5da33c984d64be1855e

                            SHA1

                            9a53667e8c5257144e24625b0ba07461b03ceec6

                            SHA256

                            774eebf97adced8b0d436070c9b41fd355b47cc22683f8fee12950527dbec0b5

                            SHA512

                            f0c538299f30b1802da1f55a97c8430bc9588bf60824b492895b757cb2a147a79e616676086444966a8e7208c0023cb104149f84641a46be08c851b306551343

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            872B

                            MD5

                            afe6b58d45a818a860133e90c9ffd986

                            SHA1

                            e09f92bf3be433a245b7da2c0fbe6ea582637a7b

                            SHA256

                            ef5fbd4d6bfae9ce8a5bc7ef27f97044f7e05c8cdbe27952a8283eaf21f47d8b

                            SHA512

                            01ce08319bd9134ace2bdf3c290eb3e40a14d254c27c9e7a020c6e0770e820d17d1db0d46ec58b056c1ba8a1edf5431e6d086e2bd655b59f5289f7f8df842163

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            2KB

                            MD5

                            7946bdfed8cb526b1a20652c71eb20c5

                            SHA1

                            72f1eb2760af61e39507353a24ab055bf31d1a1f

                            SHA256

                            367996f557ab79d3388e341b1eb26390d7eb2eebf261061a1f22d2961cba46a3

                            SHA512

                            93a3ff78a9da984cdb9124b9c627da2df3f4a8961839533998fd2b339e065333f8765f95756c2509c227eb30a259c9b7673db901cf99f56d5eca660b912b80c1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            2KB

                            MD5

                            564218326cd1b83b79dcd6e246f16313

                            SHA1

                            0f9a2435ab2c59863069adde819ee33bee068cf4

                            SHA256

                            55f206a35c2d7e02177d343a83699dbfce22ad9dcd26f557d22d38ffe2de2921

                            SHA512

                            859eb8222410339e0d032b13f5dd210a255334c0b045ccbf6df975c4eb46cd3f8e7969d7698ecee884b632d67814dbd5dca11318354caf580b73d93bd9073192

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            2KB

                            MD5

                            1b85a63c81b1b826395b96f632735fed

                            SHA1

                            8dcd49df518cd87fa0adf24387b0183f6fe089ea

                            SHA256

                            5c9fecd14f3fe5163961b94070479c20b98076c5b813486028067646023e01b3

                            SHA512

                            8d766a5efef052b3706ec1bbaacbbff91c415a9ad56db6de1af816c50af67999bbe76a28bf5d38b3dd9a7a74e5f1b24aca57db0dd1865dd942f8c93b2db8a1f8

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            2KB

                            MD5

                            1d4c996793a3a38f2086c78dbd5b19a4

                            SHA1

                            53425c3a7fc3daca045f26c7f98e2a9ba64b34cc

                            SHA256

                            4ed1d052e9a968291e0ffeb654ad6dc01271a0d4a3feef41ec5d33fe2532b716

                            SHA512

                            63dfdde04effd2d8768190d5e50bf53ad6399621a541b3ff9e1b3bf4cab292b611a7bef4b9f384caf0abaed3ac5375d4fd6f543fd74c099d9d0926785bcbfda1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            2KB

                            MD5

                            1a1f023a5f6902147414f1e4be61a8c6

                            SHA1

                            21a12e2ef5f2c82a1415021188b69e5a0f5c229e

                            SHA256

                            c74314d1720c211936c2b456e6002afa97b6212ee98aa0d7b661703d7a2543f7

                            SHA512

                            b8413c9d9014117567a8ed940d13b5d348bc4ff1b618906b1778b31fa256aa68f49405836eca020c01f8c358161da6d5604296d511993625e788a7bf5154a27d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            2KB

                            MD5

                            54aaeff9c51200a5f97b3a5e67ff9c60

                            SHA1

                            cb60050303b788eca59f18917590e787a8b3d322

                            SHA256

                            13ee1faaf819ebb03dfc6e5605c282da21d904819c495c45e8731c90daa2adb8

                            SHA512

                            ab4532c8aa452c30edd5782d369750fce16f62e3b21039138a5b79dced8506f75aacaa8ffe6560f96c3e2d851f50a175de83becdeb46d50ae2a6849a71f89a69

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            872B

                            MD5

                            ecf23aa5392fc218c502d01131131f78

                            SHA1

                            cf5f7ef9ffb2d557323849685312b424f602b6f9

                            SHA256

                            8239ccc242ce1dffe004f43b817e5dafe10da2cedb4817643b004b59882d67d8

                            SHA512

                            d32892a6cd84ea8606620258b54f0ffc7a79c8fb837dfeca543d8c6cd4e6827b0cda45d96bb4fa5fc7421a1ee9864d8cc701aec128798f6d9314475fd06ed6f6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            2KB

                            MD5

                            7ebdaa56256ec1c735a3d8fd2961596e

                            SHA1

                            46f9231444cf2448063acc66313590e3afd5d4ae

                            SHA256

                            b24c14c6fd6ae67dd8d82b3f35f9e5bc349b204df9ddaecb8ffe5ee5910c7d8e

                            SHA512

                            fbdceaf81fe7be128459ba8e60ce97807fd3f02653dd48e2bf66353d40bf09fdd599baedc6dae77a191898fccc74376f2a2d0a9cc65d55d48c643a30da88b0ba

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            7c0c621981f8e3e718d8dfc5f4a9d7af

                            SHA1

                            ee5b79726145a61e39f0ec23e962959fd2167ef0

                            SHA256

                            2216dd4997cebc7e015c316a9a964562dadac1cad6a9d61a715f3f47da4e3c81

                            SHA512

                            de10a012ef51d055930c64fdacea7242154f3c6e82d496ccac9bfe1e4794bc97cc56b7e4713f3dc3da5094b3ecd4f591cff4cf914003991791d8f8eadd901060

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            5b68eb21d46bbb333d6e7eb5a5b6dcff

                            SHA1

                            6649196ee5ee1e304ec60ceee61a4fb8fc9a6fed

                            SHA256

                            1229914ce0533513e1c8eaeb04834893946cd4cc31b5f85098df944240db8e9a

                            SHA512

                            055b72d493c2f91b3dc942640938e1c377a334b59a19ee8cb1043f6142d040dadb6321b50f0605f3b9c1b890c7059d9a0356630b44189898eaf817ab2a379fbb

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            df92d746eeeb01814f1160e1da8fae80

                            SHA1

                            97b0f1e541fdb4a5d3076645671e93b5e211b84f

                            SHA256

                            e99da1b10c2bd548f1ed6c7cdacc9e0dd43d0856c2ba005cf2c768d361d3d17c

                            SHA512

                            f59de04e1f8ee3f028e4d82b895369c2aef8363a9d86c1c7f0de3c8f803f2d740da4c30a7b5b6af85f8fec8f3b4695b437aecf4091e32039835fe2659f4d841a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            2ee076399cc87b360b520e383a909c90

                            SHA1

                            b11c794fd16aea7816f177de3b244b06506b69be

                            SHA256

                            cadfa9e5afdcef1a01c874acef218bdc7f6111aa42df96fe199f9e8341991d33

                            SHA512

                            c39ee9bd227ddda5d7716df47ebb1f29a2ee54c5ec944d7334c709d4d0ded6e92092954692d3edcc1f157529839f760aa533d618054e50229bc639f48a570f8a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                            Filesize

                            72B

                            MD5

                            0c0491ee366af19a336c189a45240c30

                            SHA1

                            483eeaa9bd7f79f88687abaad25a80524c4471fb

                            SHA256

                            ec28a07d645055fc8790fbc667eb14202f0631c3732fb88a7db348a6cc9553e2

                            SHA512

                            bcdadae6ccee42d83bddf1a73606dbb703751c8dfffd84016f69ef5bb03348609d98aaa9a673fc5ac72f1d6f5424fcb129e24587af62dab7f26e80043eefc018

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584adf.TMP

                            Filesize

                            48B

                            MD5

                            cb5c38b81389f897d270c1435a8bfc87

                            SHA1

                            2fb762ccf89cf4b7f77d4e3964c03acb456a6d2b

                            SHA256

                            981e4bd1588cb52851edd7d8790892940b4f211a7df804bf349811ae3e0ff668

                            SHA512

                            c3f34f1b63fcd55ee354f90fef56bbb39ad49e8ec303672c33fcae6354f52909bda7797ee13c5b08c8e30eb2796e1c1ac60578a33e7159936f336b1bfc85d732

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            136KB

                            MD5

                            36775b7fc5bab0983a118a046542fa42

                            SHA1

                            e69088b4ab6a144d1952816df27c5ae2f657d4ac

                            SHA256

                            a1af302a48309f205b369242f22f18cc4db8e557e686465b54944b1c884e1fe7

                            SHA512

                            72ef3804013044f469c1e164db2312bd4019439446398c7fdadd9079231761b6b585d67037af981877592675ae7e131240d32dcbea77bf0967279172c13cd9d0

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                            Filesize

                            99KB

                            MD5

                            ac286f97df72ac909a4338cd9837ea6d

                            SHA1

                            154fa23551735e322fccfae02ee2002e43edbcb7

                            SHA256

                            ff64b2fcd5f48d34fadee76ecc2c81f90fe00c717ed0dfe1f314da34e6f0e235

                            SHA512

                            42bbab00691a396a51b10ae735ef133f8e0bef18a274162f2773a456dbdb6be8df10499baabe8a5b73fe199d51dd2bfa470cf44cb2e797f0a21cda6cd599e25f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5821eb.TMP

                            Filesize

                            97KB

                            MD5

                            04284ff586fad60d238dc752e64e6307

                            SHA1

                            f279e194fe38b9f3a7f6a5d78bc3f5be2eb914a3

                            SHA256

                            095ac2b82591697686f2bfd10c9eab223c18a75a39ff910d14f2f78aeec22f63

                            SHA512

                            5c96333df7fa7f4801c24d16548f8c7914342733839f90f28e185b40c431226d10d0b51c771687be2963dab79403f7aa54c07b7e9c1fdc317c5ea8b41fa53fec

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd