Analysis

  • max time kernel
    78s
  • max time network
    69s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 22:40

General

  • Target
    https://u.to/1KPCIA
  • Sample240703-2llw1azbpp
Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u.to/1KPCIA
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e5c4ab58,0x7ff9e5c4ab68,0x7ff9e5c4ab78
      2⤵
        PID:4020
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1904,i,3024656196205820654,3982394350655110947,131072 /prefetch:2
        2⤵
          PID:2200
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1904,i,3024656196205820654,3982394350655110947,131072 /prefetch:8
          2⤵
            PID:4804
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1904,i,3024656196205820654,3982394350655110947,131072 /prefetch:8
            2⤵
              PID:3436
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1904,i,3024656196205820654,3982394350655110947,131072 /prefetch:1
              2⤵
                PID:3980
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1904,i,3024656196205820654,3982394350655110947,131072 /prefetch:1
                2⤵
                  PID:3944
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4208 --field-trial-handle=1904,i,3024656196205820654,3982394350655110947,131072 /prefetch:1
                  2⤵
                    PID:560
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 --field-trial-handle=1904,i,3024656196205820654,3982394350655110947,131072 /prefetch:8
                    2⤵
                      PID:4292
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1904,i,3024656196205820654,3982394350655110947,131072 /prefetch:8
                      2⤵
                        PID:3376
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1904,i,3024656196205820654,3982394350655110947,131072 /prefetch:8
                        2⤵
                          PID:4488
                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                        1⤵
                          PID:3300

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              the-real-index

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                              • Size 192B
                              • SHA256 4c26cf80950243b54f3d61781e051e59aa1829382c69494a04cfb58576d0341c
                              • MD5 SHA1 SHA512

                              Network Persistent State

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                              • Size 1KB
                              • SHA256 dafb2b55d69db662624bf8cf32c2e946ffe5744764913ba575c188445b3beb7e
                              • MD5 SHA1 SHA512

                              SCT Auditing Pending Reports

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                              • Size 2B
                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                              • MD5 SHA1 SHA512

                              TransportSecurity

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                              • Size 522B
                              • SHA256 e5465cc2c3e578374a17bf9526875278c4cd670dd57ecc2c06125f973723eb45
                              • MD5 SHA1 SHA512

                              Preferences

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                              • Size 7KB
                              • SHA256 e8cfd84492a34743c74429d52f670c0b5c59a9932d942e2de1295291107f3711
                              • MD5 SHA1 SHA512 SSDEEP

                              Preferences

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                              • Size 7KB
                              • SHA256 7c7b993705b0688726c4250f30e52d6dcc551f56140015aa44e55e9f15e736be
                              • MD5 SHA1 SHA512 SSDEEP

                              Local State

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                              • Size 129KB
                              • SHA256 cb14e210caa61d41c1b628483b05d143ce949c35df79da02c1c4ef789b3d216b
                              • MD5 SHA1 SHA512 SSDEEP

                              Module Info Cache

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                              • Size 89KB
                              • SHA256 f53776c9f339081fc908318749786b0623851537fabe501fdeb48e83eed4ded1
                              • MD5 SHA1 SHA512 SSDEEP

                              Module Info Cache~RFe57b7f6.TMP

                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57b7f6.TMP
                              • Size 88KB
                              • SHA256 febab4cef5fa6349d3bb546ba2bf13c7553ad8b62f00ea3733ba8d96f34fe37a
                              • MD5 SHA1 SHA512 SSDEEP

                              default.dic

                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                              • Size 2B
                              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                              • MD5 SHA1 SHA512