Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-06-2024 03:05

General

  • Target

    sample.html

  • Size

    170B

  • MD5

    f91a416be352a03c76b6ce8f948eda4d

  • SHA1

    28f1cf539f855fff3400f6199f8912908f51e1e1

  • SHA256

    7bc15a9ba71464596444ad648fa144937b848b302459c4103deae105cf42ce42

  • SHA512

    9f08f3f47988a35936532d0bfb253be943e62bf6f5d886679be7e6403b15c8723bb5afce9bc0b4fd6b5c01571a087887c3ca2f515568797d15b53d8a40e4abc1

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbd88ab58,0x7ffdbd88ab68,0x7ffdbd88ab78
      2⤵
        PID:2012
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:2
        2⤵
          PID:1564
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:8
          2⤵
            PID:1964
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:8
            2⤵
              PID:4088
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:1
              2⤵
                PID:4980
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:1
                2⤵
                  PID:2236
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4228 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:1
                  2⤵
                    PID:5000
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:8
                    2⤵
                      PID:4704
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:8
                      2⤵
                        PID:2616
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:8
                        2⤵
                          PID:2160
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:8
                          2⤵
                            PID:3776
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:8
                            2⤵
                              PID:3260
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1892,i,2008348948851190093,17673411558858600355,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:468
                          • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                            1⤵
                              PID:5056

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              ac80eeda152de5c784d9b31cdefeeab1

                              SHA1

                              34bcf32ee4acad650570f19b91af667b308075e3

                              SHA256

                              188f122f8ce340c341baacd266dc35651a59123d213454f3174ccb1100edf01b

                              SHA512

                              603b790cac64c43dd66b924f21719ca8e1580e21c3ec471f4b84a0022ef0cd0602b96809ba7448b7e290f6d0ccd0b1c378735100d548bc6d000593d30224fe5c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              9b52cf5e43a124447f40c6efb6c7a244

                              SHA1

                              d8878da89112da95beae1e739eb6d43e09fc7bb9

                              SHA256

                              cc39411a5d35c35fb44ebd1fac41e6a50e567d2226acb90fbcbd1020f0f9dcb1

                              SHA512

                              a6e4d230f6eb4312df56f481aacdf8bfabb64ac0df0d75a99308f88415cd2e1edc07aea39f9c77219b12b4e7819bcf343b0e6e7a629867896255ea7ec927c1b6

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              257KB

                              MD5

                              8774c78ef5dff199622826af88b2dba3

                              SHA1

                              8e60b18eba6b1bb1fa0469b7c446fedb72935af0

                              SHA256

                              8d9ab8e412c03a23623a2270dc6845f73edf264b7bdbecd3ad6f365edd42748f

                              SHA512

                              e0e8fd81fd031e3072cb34fde6f33813d77ed865f247aaf1022e152bd36338923075de4b7e43ff59e95c07bfc5b7b58c8fafa08fe8ac1fc26e672c334f07779d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              257KB

                              MD5

                              22f607cd4c50c03911b259a86763433b

                              SHA1

                              d8cb55901a7d722886eb967674d4f3ec7c4ad005

                              SHA256

                              9b7f90e10c7c7c4ae446ed12f85b44a5ea2a4e45c8b0cee2e7358bc0728d162d

                              SHA512

                              9adf9a6f8ea53e0783a0d0ff2deba48952f30ce6a9f622d01cf7cb24dafbfb53003d282731c79e626239ab19b07b5a1cc27720f30b1b2fa1915f39291161de7e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              277KB

                              MD5

                              986639098ffd343b885a4e8c2995d385

                              SHA1

                              f1faa0d289b442bbc962fd5b8c14ed12fc734c97

                              SHA256

                              20d1426d6a3b8c4380fe9f2033cf48befd1b267dace8020c2a2e64c0efd09e1d

                              SHA512

                              d8258ba6c290791cc84485a09211f5cc13fe678ab726765dee06702129cb7dbe16e111213b2e7831ba933e1520a76e4c15f0a8cf84e5136227b3fa70d78ff721

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              257KB

                              MD5

                              a1c3825b19e5e489ccacdd827dae5674

                              SHA1

                              beb0746e3da14494d801f21fca7283ce87189def

                              SHA256

                              032ad285b917f11b1682809e8758333d6ecad58adc6756cc9d18201e9c19230e

                              SHA512

                              afc47cf201a41a6dbe11cd915c666e944c54d13519c9afafe20f9cf1274cf72d429c204574f5ed5bf7d61d7bdaee4214bc6c0e2f3b97ebc1edaa71e201b5ee17

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                              Filesize

                              91KB

                              MD5

                              be008316a5b60ed556fda2f623a81aae

                              SHA1

                              cf030900e08b2a0b63f33f8c0d995c0bf9dbfa8c

                              SHA256

                              2d2be0a6576814a6604bc609c953f510fc4cef1dc26e8527e947bcd2a36ef3d5

                              SHA512

                              f2fd0c4e70863d01d1f7e1c0ea3cccece82f50d5375be919a19d2939ade18a74083f59f9ca425771bed96cfb9099ec568ef630edd366f414d0d4259db0ca0cf7

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5826ec.TMP

                              Filesize

                              88KB

                              MD5

                              460f2db51c1285bfe4cdcb3e3de7508f

                              SHA1

                              b9c6c126d4e55531bd5fa3686d489006c03ba77e

                              SHA256

                              f8987ca43c1c654aa895c830c40cb49fbfe73d3f113590bc3506c0964a984ba3

                              SHA512

                              f5acd067ae5e35a3b8f415e680f1231a128223484fc4b086f6fb042a757568e9411dcf59e79d513a77273be00744e8b35fcf6a6fbe5be3bb9e2e121f429fb783