Overview

overview

1

Static

static

1

URLScan

urlscan

1

https://www.g2.com/p...

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 08:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    https://www.g2.com/products/appzen-appzen/reviews?utm_campaign=EM-FY25Q2-G-AppZen-Coach&utm_medium=email&_hsenc=p2ANqtz--_n2YIIEdeyOQeBPbTTxHf9jWPdaHUi8fl2s1qeerBvRgWbiMyatvmsb2Fsc1-eXnA5_mysWUdpKR4aqHAE2EXn3O5nQ&_hsmi=309491560&utm_content=309491560&utm_source=hs_email

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.g2.com/products/appzen-appzen/reviews?utm_campaign=EM-FY25Q2-G-AppZen-Coach&utm_medium=email&_hsenc=p2ANqtz--_n2YIIEdeyOQeBPbTTxHf9jWPdaHUi8fl2s1qeerBvRgWbiMyatvmsb2Fsc1-eXnA5_mysWUdpKR4aqHAE2EXn3O5nQ&_hsmi=309491560&utm_content=309491560&utm_source=hs_email
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb41c4ab58,0x7ffb41c4ab68,0x7ffb41c4ab78
      2⤵
        PID:3556
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:2
        2⤵
          PID:1752
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:8
          2⤵
            PID:3544
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:8
            2⤵
              PID:3168
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:1
              2⤵
                PID:716
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:1
                2⤵
                  PID:4904
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4204 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:1
                  2⤵
                    PID:4280
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3204 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:1
                    2⤵
                      PID:4760
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4360 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:1
                      2⤵
                        PID:1532
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:8
                        2⤵
                          PID:4148
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:8
                          2⤵
                            PID:1248
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3996 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:1
                            2⤵
                              PID:3232
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5024 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:8
                              2⤵
                                PID:996
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3044 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:8
                                2⤵
                                • Modifies registry class
                                PID:1988
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 --field-trial-handle=1896,i,13382654307648711204,14223023378865091565,131072 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1248
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                                PID:4392

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                      Filesize

                                      1KB

                                      MD5

                                      c1cc6a7936be0e1689b6cfb9080c7c55

                                      SHA1

                                      7e209255810887b29a55090ab114d171a56448ed

                                      SHA256

                                      390ba7402eb7b10e73d6ca28c5467902b62ec37767d18f2c28ee8fd022ba623b

                                      SHA512

                                      9f31af9366cd70174843ff559bf611070e38ee1369528d93c8d90f6fcde032b8db3d071bcd814e3a89b2811cdfdca79866e5a6ddc2f43ae4cb673696373fb5d6

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                      Filesize

                                      3KB

                                      MD5

                                      e5dfdec2f730503df84a2646ff5ea49a

                                      SHA1

                                      81778c4cad5efe626c53eb025bfcdf9a887d1dc2

                                      SHA256

                                      87eb3f40c6ad4feef60ab5e94b6884aa0a47321220294ebbaf7b04ad02982688

                                      SHA512

                                      4a3de36d5093fa9c0b8eed887b05b6f7f0405567c7c7ac54574c201e853a0029627ab45dcff199fd0b42db5363200df2b4f7e29aa8bad4d60964fe6780f86ef9

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                      Filesize

                                      2B

                                      MD5

                                      d751713988987e9331980363e24189ce

                                      SHA1

                                      97d170e1550eee4afc0af065b78cda302a97674c

                                      SHA256

                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                      SHA512

                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                      Filesize

                                      1KB

                                      MD5

                                      6032e5b1ca5ebee336996e26ccc7f40d

                                      SHA1

                                      f340c79c32cc2f3cabb9987ba15764df4440b991

                                      SHA256

                                      fda1f917a21d34f04d5039c222920cc53f80492a394d7e330f0ab16959e95635

                                      SHA512

                                      b9f249bf9ffd96fa3c518a75a10b52bf0f443d784c3e3cd536ba6d70d3769fb0cff2e5a4cc95d1fce713edb9cf0a2f78fed48dac82d8773d81b7af1ffe1b9c63

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                      Filesize

                                      1KB

                                      MD5

                                      9ef8f569cf0afc9e31ad257e6b1980f9

                                      SHA1

                                      c3b65cf02add569dbc29bf0ac4961f0514dd8904

                                      SHA256

                                      0470f0b32101ae8f9f8087be29977175d0ff6f2a94660da4511ed20674bf002b

                                      SHA512

                                      0af48b87921bcd29ae4d2295f5b4e5756ec3d4e0ca824423a74244277f508ab8da1cfeffcf2548c86de2ab73f362e794cdb9bb2e1d6ec3c4fc93ccfaa31eeed0

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      Filesize

                                      7KB

                                      MD5

                                      ec853f0a1ff71b5e3f1797b27d37bc3f

                                      SHA1

                                      a9a2ca78ff741172359e4e89e630e75e6297c31b

                                      SHA256

                                      f0137b58ce5d0393476d0433d8355a5565d98d9b2b73ae24fae3034f1c2f5c6a

                                      SHA512

                                      9d444b9ba589f4ebcf8d6201d85881ee3c67362571acfbc22c5842c370b45b82c54fda3d197c99b81187e22e203aea630f7389e125d3857e764c0460b783e6bc

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      Filesize

                                      138KB

                                      MD5

                                      10db089c57e45e0842a6902dd6f72ad5

                                      SHA1

                                      480b2be4e4e43c8f46fd8e3f0ac22a54a45c1e48

                                      SHA256

                                      5091830517efbd372b8bb90bd4df3d90a56754ad4c98efdb86a77f26f6972e89

                                      SHA512

                                      c0a6d9d62547dd0bd202174951ba5be1d123fb11a0368f8234c5a6dcfa671a7df8c0e8baf833b19e3dcc3afc628a069edd4612a3d243d87952744398dfd89f24

                                      Download Submit