Analysis

  • max time kernel
    599s
  • max time network
    596s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/07/2024, 10:48

General

  • Target

    https://www.ojrq.net

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.ojrq.net
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4468
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff536a9758,0x7fff536a9768,0x7fff536a9778
      2⤵
        PID:4976
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=244 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:2
        2⤵
          PID:208
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:8
          2⤵
            PID:4864
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:8
            2⤵
              PID:4492
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:1
              2⤵
                PID:4364
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:1
                2⤵
                  PID:2832
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:8
                  2⤵
                    PID:4812
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:8
                    2⤵
                      PID:5080
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:8
                      2⤵
                        PID:4548
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:8
                        2⤵
                          PID:3048
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 --field-trial-handle=1844,i,1544937823854748624,1691459743072382197,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:352
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:2052

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                9831aecb9fb478d51eb9f658ea8431e2

                                SHA1

                                fd4b5ef447cc4df39ed170b282c702c37b67b5fc

                                SHA256

                                14e025fcd6a13878a3fc15a2e33f5f85d389e962d3a2daabe847126fdc6fad3b

                                SHA512

                                6e1ad45a07458f38e135dd2e2ee2632b5d1c31b82d2e02672565e0a267b56bb752341022d86f4dedc1c99fdc02bb1ef1adc6291eff0a63736209d47cc8a04d7c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                873B

                                MD5

                                b2a07e7f137ea6dbad08adfe8f9fc982

                                SHA1

                                b7891221396bfd23c86329070009c2d7150ab55e

                                SHA256

                                c01dc8fdfd3318a9b8809427e5afceb28ada6f400d64f3817c747ff0bff0e304

                                SHA512

                                09981310e1774b3a422a04c16ad46ae61785afbd4dece511866beb8a6c17a92ae080036314ff876bd61c50dbdb0b827533644642aab094a74ab8de73c226948a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                24c7f65d02fa4265e121486f153ffd04

                                SHA1

                                26113bef8be3f90484ea56de0dc10477909d9682

                                SHA256

                                d403f1d0f8a52b459473e848b74c1c3a4e4df805ed5be6c3c0ad32d289f2d883

                                SHA512

                                a550e3e7ff331f2af0b003d98617df5eeb80bb8c3fb9e733abad5559f9918d3cb6a810ab05149a1c2f1f3e8619e4ceb200385f2ae1859d49e7091c2e05d84ebe

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                6088c358a2641d0872be3f1bb2cc4252

                                SHA1

                                97ae3da559082bd2c7aefda8d2e63937fb1e5728

                                SHA256

                                6ab60c026087fda9ec016726b2772ec0b930f777f4747e3b76a2618eb9c0722c

                                SHA512

                                9cb0ab4b07719f331e7497624bf5edada6449e6fc91a3f82a0238be5e3fadb2440f0c1774e9660207c56b821c111c19c5e5e7e7387098613fe0dfc2ea4d9fae2

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                603ec216204da8236c4b1aa2ab1cb732

                                SHA1

                                d4a7b252b83b97b6fa5de992b29561cd4bdb1a12

                                SHA256

                                cb45ac22b422bd661a003bf70cdada80a796fc6a97b630d72b0dc9e57558cf4f

                                SHA512

                                56069ccdc30e0c476bdd08a366ad25150d769ec31cc758715f45f5de1e3aa8c6a5412a7391050b49624a627c4a897c581ab49bbe68c16b8d92e5aa8f43c4916a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                150KB

                                MD5

                                9b892e947a53faf0df9a5d3109fde5ae

                                SHA1

                                4fb288d85c6146ae45bb79ffc72938094e7a791d

                                SHA256

                                2b31e8eb24807e827e89aa1bd90f011d9eb65a8efdf5ff7aa753d4a7ece37714

                                SHA512

                                ab5b548e89813b709890f1813241cdac8b404afdcc34b5d5194a9fd1538806ed566c1aaba1b371b84e003304cde371f4a58b259fa13b74ffaac0d7969c2645d5

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                191KB

                                MD5

                                e436eb98527c8929a67379ed4c371466

                                SHA1

                                7d464a459b98e49fd1d81a731c2f220a04d23f4a

                                SHA256

                                3024826a4bdb9828770d0911e2b3582144888044cb18c64f32714388dcc3b796

                                SHA512

                                0bfd8d6225dc61ea019f9a6a80abea908e6d666acdfffc5976aa951516336065b2ce3bbe7c4119fd09ceda619d652764507573b1224059c37d190da2812dd3e6

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                150KB

                                MD5

                                bf2707dde098b1d041cf754d4045c373

                                SHA1

                                0c1a5246d2dabeb5b25ecb9d5409d7d9f4704cfe

                                SHA256

                                f030b3b1cf65d063f6ccf6bd46678a9b8c9c87b9d997fcaef392d747e1f99353

                                SHA512

                                9bd782fd31f19bb7e799164d35ec0effba433d56227b4cb8db413cf764586f006ab1d024343b23cbb7bae7c00aa8d09be55a93f9c95c77ec8aef85953f9a9272

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                150KB

                                MD5

                                47f470a4d5c0c75241dfe6042f648b3b

                                SHA1

                                aca70a4d2acbe31393babc1dc8ec5b5a6f55bdfd

                                SHA256

                                c2c362e88ba36fbfdbfb0eae5007c838f92bfe112d032927f9042bcf20d5144b

                                SHA512

                                c58a6497dae12cdc2d57fc968d3c69078a4782e6ddfe8a2ace25431a8d28c582adfb4f8e7f45368a223685e426d3d3df232255e3e596d86247e49b6b4e484250

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd