Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17-06-2024 01:51

General

  • Target

    https://u.to/lz6rIA

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u.to/lz6rIA
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:32
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcb8cb9758,0x7ffcb8cb9768,0x7ffcb8cb9778
      2⤵
        PID:4604
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1824,i,3647350202023825071,4759402460129864043,131072 /prefetch:2
        2⤵
          PID:1448
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1824,i,3647350202023825071,4759402460129864043,131072 /prefetch:8
          2⤵
            PID:2892
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1824,i,3647350202023825071,4759402460129864043,131072 /prefetch:8
            2⤵
              PID:1008
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1824,i,3647350202023825071,4759402460129864043,131072 /prefetch:1
              2⤵
                PID:1880
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2920 --field-trial-handle=1824,i,3647350202023825071,4759402460129864043,131072 /prefetch:1
                2⤵
                  PID:4512
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1824,i,3647350202023825071,4759402460129864043,131072 /prefetch:8
                  2⤵
                    PID:5076
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1824,i,3647350202023825071,4759402460129864043,131072 /prefetch:8
                    2⤵
                      PID:5060
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1824,i,3647350202023825071,4759402460129864043,131072 /prefetch:8
                      2⤵
                        PID:3152
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1824,i,3647350202023825071,4759402460129864043,131072 /prefetch:8
                        2⤵
                          PID:2656
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3768 --field-trial-handle=1824,i,3647350202023825071,4759402460129864043,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3524
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:5108

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          72B

                          MD5

                          73cf87fc8a85939b87c7b900c3aa277f

                          SHA1

                          91d05b34effff61b5e7726df7db4366331a917c7

                          SHA256

                          e175898934ed1a2e66170fd243a746371b55afcd5edf628d8e7547508529c960

                          SHA512

                          ebc4a83e8bbc480c2cb4b70b01d497057f18bfda753c4c2239dda3302bf0c2f61ca9ac617920936c77a6983070c4bcb0fe1b37b3a034009d1df7ee3502a96a02

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          8449646c1aa44972dc2e91ca4dd25831

                          SHA1

                          d6bd17f45ce9b10163e873b31804fdb6e5f4f743

                          SHA256

                          aff45b7cf83a27bc196c9db07d8eca986ffa648c032db6be2694b992292a41a4

                          SHA512

                          01d35e39e3bd4865df4ee3a7651aea068ff4d41eebf3529f6d357d33a7483ac418eb7c377b9f6e47f322a06f1a410f1d3bd5b66f1574357a67cdcc7708cb557c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          708B

                          MD5

                          dcc4223c9764f0254eb9ce83394e4e6a

                          SHA1

                          79ef5d65f26a0354daf558e6b688acc43c246dc7

                          SHA256

                          9508bad05b6b2b8de144a31231a8a15a35492c14a103adb26a0f9da5fdfc4cac

                          SHA512

                          90091a0029fff94cfd6e660156b89e8fdb75aacb4a7208c14dbe013dee675c1a92b5d69a8fb80d489c6cfc291ca0ef97a8b137bc7b37221928d3a362caa029d8

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          708B

                          MD5

                          0a15da14e66386c9c599275b27aa4c9e

                          SHA1

                          a1520a5f0cf8ca2d38ff073d9842e98ad177069e

                          SHA256

                          a284953d92847bd399a222e291a488682e3759946b9d2743cff8c25642c64467

                          SHA512

                          5c85d31fdf3dd0de7b781639369bd895c0b66d1d0c5bf15e63005cde78e566fafef7add0e821a00a7ba62a589d7e652f6f3ea0d71c030c7de450610e373321d5

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          872d5f704800be2fa9f9317b98bf5972

                          SHA1

                          b8de6c17988b0c04368d32df32cb30e49aff79e8

                          SHA256

                          d9455bc526d1d770ccfa4e95c6d443c13bf56f2c9c3776b321301b79cd795fbd

                          SHA512

                          100d2423b76ec29fcf9b3dd9a9cd985aae6012bfe5f651eefdd424cd30e19f43582e04c5916d2d21dc9622b901e0aff9eb2ad87c25dce417810883e5a33bfb35

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          d8c100a142f38cac87ddeb1a71ab3e1c

                          SHA1

                          3386b83b1cff504e9c39d7180bef782aa611bc01

                          SHA256

                          9fffdf02496cde1bd4cb3e4835912eb938d8b015e3e6feed1a458d093265d19d

                          SHA512

                          b29531ccd5a0c1ec285875bbc126db68cbbf04bf94ac37abd526044decf15253c8d3ccc601303eeed60f1921b0cd7a6bb3b0455c5038cab1c19e4030a99e5658

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          0489a8e878fad6cc7b9f765d0f5bad4c

                          SHA1

                          cff7fe08ca8994d49972cfeb66cb67b924b813e1

                          SHA256

                          55cc9f823e7fe74746a8f3b2df0e430b4483be952da8fb734c73503bc2d2d85b

                          SHA512

                          0d28d91f4f957eb2242f1248df3b07180be2c0f367b49ed75ae4973cfeda8d58cb7596963e28556c1d6e3b8ed6b68e154a07a8a115c60ed50f2212b74036e4a2

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          150KB

                          MD5

                          e95cad0cc1fed9960211ca4dc44992c6

                          SHA1

                          af9f5bc5dd2f352f37b8e229ba35914e0d9b5af9

                          SHA256

                          ed1b7fdd1abae40a0089ac30e1bba37e6122cdeb77614a1bae35b8190a004aa3

                          SHA512

                          e28a0bc5762cbceaeb7357d21409ca606d5d48a7443726037aaff0c6f79075ba4578c2a050afeb89fab1f120e45445bd1eaebd0d005632e67d9fc20da403a33f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          150KB

                          MD5

                          98044294b0590ea49ed7f9fd72fe5e78

                          SHA1

                          712aee53a002d89fc42f07d67521cc8b53ca6feb

                          SHA256

                          7cba0499c39d3e7501555957a388886589394ac49c232a94c39b8f60cb97f315

                          SHA512

                          89f0e4c29dda8eeda0f57f15ab392848fff8fefb2a5ec9e88f10ff6ff074b5053ba2837badda58f29f608e3ab39cf1cf33781ca2689f2d7bf6ed4ca3aafb1988

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          150KB

                          MD5

                          4ebde5b97a639272d405fd790540f427

                          SHA1

                          754f7e67bdddaba673af50307e448a5a8aa0d02e

                          SHA256

                          ee270c3c35737f64d65daf950969fa2490436b1c9de6547e22f3755db21015dc

                          SHA512

                          a07e9ffdf6118222250723109d9e8468fe5c55b5eebb08060fbe20d94cc762c1fdb51ec1a5824ae0a92565e0c398334c9f028b087dbaf01fbfd6dc0602fccc24

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          167KB

                          MD5

                          b090126f73db15446dd8998cd0e7fe61

                          SHA1

                          8f2ca9cf94fab0d8954a68e1c352582d2a6807f2

                          SHA256

                          aab12d81f84e96306e7327436b400762bfecb4e8641190950f04fd36804e4a0a

                          SHA512

                          bd86390d5941f60e7e084fda002b6b7380f1d7cdb849bec5eb8f7175c5abe5d48f2f8f322341028a59f2cf31ba7f0a82919cfedc0a0aaaee70fba12b429a4138

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                        • \??\pipe\crashpad_32_HGWUPTDHRPXIMQDP

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e