Analysis

  • max time kernel
    49s
  • max time network
    50s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-06-2024 22:16

General

  • Target

    https://u.to/gJu0IA

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u.to/gJu0IA
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8537eab58,0x7ff8537eab68,0x7ff8537eab78
      2⤵
        PID:1512
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:2
        2⤵
          PID:932
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:8
          2⤵
            PID:1160
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1860 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:8
            2⤵
              PID:3160
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:1
              2⤵
                PID:388
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:1
                2⤵
                  PID:2352
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4276 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:1
                  2⤵
                    PID:3544
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4272 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:8
                    2⤵
                      PID:812
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:8
                      2⤵
                        PID:2528
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:8
                        2⤵
                          PID:3048
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:8
                          2⤵
                            PID:64
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1768,i,5263601893683553557,8438397023222899235,131072 /prefetch:8
                            2⤵
                              PID:3444
                          • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                            1⤵
                              PID:2084

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                              Filesize

                              192B

                              MD5

                              c1778748b33001fd81afca4b63d3632e

                              SHA1

                              11a3b68f3162649c37c1332849a83f0f2510db7b

                              SHA256

                              e2099ffd317765ce797a3baa0806a30a1da0f5aa77248d5ee2746c7b0bb671f2

                              SHA512

                              19827e57f8df7d219041e3d7affb3b613e40a3030f31e419c2bc53d87edaa2072a15af98d946129f670503896eecd66bd992adcbe95da178a5b7836e1a0c3327

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                              Filesize

                              524B

                              MD5

                              5163ebe9de041b14e0ac39e0235890c6

                              SHA1

                              c996fbf9971d4e487534bfe45d6482ff058ed184

                              SHA256

                              aee5a037b728135e66a18e1c3deceb900e9c81ad1f1b027565dc37d4c81e8aeb

                              SHA512

                              61eb9d220d12b476ed32f2da7d3a1dd89f512b2d525609084e4290323438f99fa8b782ca657c4c788f9659cb6153eb25aa02e5421d448ef3d1ea8f521c102665

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                              Filesize

                              7KB

                              MD5

                              d766e94547d42c6d807cdecc212ac6f0

                              SHA1

                              83c40515b0fcd175652bb10c6e7135e371fdc180

                              SHA256

                              55064e7114abb11bc131772dd6c840165a472c0e20c4020d0ed1d521bda878f9

                              SHA512

                              c044115b108d3ad4e9fe72497419575bcd7e7a567330218dc547fc603328078294b79e3157198fb89a16e4dd06e3ae9b8b49f869ebcbecb21e8a317000eb30b5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                              Filesize

                              7KB

                              MD5

                              d18157838a842f6929b94d2b41aec3f7

                              SHA1

                              be4c51b3e8e572c8531b06a57518691a4fd34c65

                              SHA256

                              c2e19fe9781116514acb45cf2810fb9a50a11d876c793b78421ef0cba71e990f

                              SHA512

                              83b5693e549129c49e0de132907d6137776c873bbc5a84873df995ef90b179317753e3a9966ad71df5429dc6767b940fb8cb2d71693c5df0753234d4202c4360

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                              Filesize

                              131KB

                              MD5

                              6a0b3b3a0a9f86ce347534ca53df221b

                              SHA1

                              ccc26e927c78da953c037dd504a25af0c90fbc2a

                              SHA256

                              a26028714bb02e47607725690dc2b03d22edd9188efac7e4645790b5de8525b0

                              SHA512

                              0e3f195b5472f0df72d742d96a6b4d488a6b87908fb5446dccb6105b051a773923af66019d2131bf13d5787f5ff261574f6881a70ce105bb3a2f8b26a15e6447

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                              Filesize

                              132KB

                              MD5

                              4f7977b87d65e176fddfd15ee04bb3d7

                              SHA1

                              ea8837f17190af314b953d46c738fc359a633606

                              SHA256

                              6d063c611476c89abe697992be95157c9e6f6fc9669111c1ac83451c1a748d8c

                              SHA512

                              6a0b588650a25fe65f58bb4736d91d58ddf347fd2afcb08e008e79072fb7a6176a7df7a8767c14860e8b58ec3ab69e16215b579733a5d0e4dab083305d4e7d8e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                              Filesize

                              91KB

                              MD5

                              5a9dd29d0a6c4a0cc95bc8adb256796f

                              SHA1

                              58751a642bae61bc9ed1ac21ccdef42cbc589820

                              SHA256

                              fe314d2278f3a559a6d4a5b469891bdbd7434586bb3529c28bdc53d8653d2dd0

                              SHA512

                              2c7e8a1341bf101896f07d9e6f159dd6d50c6fb330f10035a6e661aceb9fe34bf3662c0f27a2d9c1ef7605ec70d61961180ffd061837c075dd867ae66732733d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d0bd.TMP
                              Filesize

                              88KB

                              MD5

                              1814da7b204728eb16cba7d142b7c2ab

                              SHA1

                              148046628f215af564d4cf0090860273ff64f7f4

                              SHA256

                              697cfbaf3e14c3200b118db5fa3335d7c118422a27288cc94d8f0a894b2269ce

                              SHA512

                              8ee40db14ce7c3445434aa6bf208a7bb8b1267c3122bc7879fa3442169055489db1130dd26ae4290314528eb52fd79f45d1a830d0dbfd943b367e1c82f39f114

                            • \??\pipe\crashpad_1612_KOAWBCZTOGGMVJLE
                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e