Analysis

  • max time kernel
    599s
  • max time network
    590s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/07/2024, 13:59

General

  • Target

    https://disney-crossy-road.en.softonic.com/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://disney-crossy-road.en.softonic.com/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:588
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe349d9758,0x7ffe349d9768,0x7ffe349d9778
      2⤵
        PID:2596
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=300 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:2
        2⤵
          PID:3036
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1768 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:8
          2⤵
            PID:2944
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:8
            2⤵
              PID:2928
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:1
              2⤵
                PID:2844
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:1
                2⤵
                  PID:3448
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:8
                  2⤵
                    PID:3764
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:8
                    2⤵
                      PID:4400
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4524 --field-trial-handle=1468,i,1691229741289850873,8803993153076935342,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:592
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:3192

                    Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

                            Filesize

                            1KB

                            MD5

                            55540a230bdab55187a841cfe1aa1545

                            SHA1

                            363e4734f757bdeb89868efe94907774a327695e

                            SHA256

                            d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                            SHA512

                            c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

                            Filesize

                            230B

                            MD5

                            147d3c47a5142ba47b8526a729835997

                            SHA1

                            637ece7d8d76acf796586a0c289137bd5f12bc64

                            SHA256

                            57a482bcb6a445f08d5a04f604c3cf0dc858a0d6336a4a38a01f171d55350d50

                            SHA512

                            a1ed14cd5d34bf678438de6e1cb71c5c02115dd0a471266b9f437fb4322f665fe2d78ca8e9119a0d45c480c7bc12d44b18df27fe4bf5f98901a254da696c0ad5

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            528B

                            MD5

                            54fb5fef02f7008cccfb8fdce33e8621

                            SHA1

                            d99991a5dd6589eb9e11cfde6959900e9f163e7a

                            SHA256

                            0846c56281f5162fe8a662e6d592ac4daee64facb57ad4204eb46371fb542262

                            SHA512

                            ea0a740dbfc5733baf7922807e37ac7d59a7ba90c6c1f52ca954a727e0fe5561fdeceb0df3248f27cd068bf42ac481a5c3aea0471e11b5e107da576eeb5e05d0

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            bffc3e11fe9dc5f183381fa303449758

                            SHA1

                            ab9749a64cd3b3aac41fc3e4bfca5bd12df86614

                            SHA256

                            e8ccd9b0c3d5b4e4d60ba6e244590a40c6139cf965869d52e57390a391238505

                            SHA512

                            b141a654ef7e73a13d79d461b8f78361cb60819ab1e16211d9b75550f66c72811d7ed9917d0529f751bdcec20840b2ef189ab8c5edbddd287fd9e49b39377d45

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            f09af4700b6ffa1b27f56bb11ada9cfc

                            SHA1

                            baf6f5d696d30e8926682f0003dfb731f8970067

                            SHA256

                            380e827252988d04daffb59a5aded33ad261ec2b008e8e0ffe2698218f1d5683

                            SHA512

                            959b8346c0c819a8fe51e8b7e85c3ecfc2015258ba2fc5a5a71a55af18fd0f3839900eeea3be9ff56a8445a06527f7c32493bc9c73b48ceb18daca39488f1611

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            c5c606e79f1f4355ff46696ba50b478a

                            SHA1

                            ef359e2dc47e0c119e2719a1fc78a204b4d37766

                            SHA256

                            faa79afd7ee6baf7f60e17fa67b40bd11139bd0e65972fe92c50604a7989e0eb

                            SHA512

                            bc768c5d55691012ab220cbf49c926c520ec2f670b3776f375b876883188d3846393e012087c71ed797e5fe9b2c3fd8417090bb9852b75cb88b9c4e21c80ac0c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            9c7ff8f2f7f21f245534f3ee71a67be0

                            SHA1

                            c6e046a1f202c9152df4d6cc88faea7db8f4769a

                            SHA256

                            0c332e73524cf3821f57b956a9a610310614dc32757765b99fcc8dca0c0f9f65

                            SHA512

                            f3fa536e0567ece2f0ea70c88e990c349fbc3c9f6152d9e9fc723563fe544ce102644c90c46dcb2d67ff24fe8db35aa3543034b9c2ab3ac60f1fe6d2a811e49d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            bc5a52090260b995eba8a6462d1ecc16

                            SHA1

                            c3bddfc07e7b5623fa162980eacabeb0fcde9871

                            SHA256

                            f168bddec5e2b3c09a635bc4c30fc50ea3016653a35fd2e4e040706911a25755

                            SHA512

                            b865bae68bb49f6e3ede6bbd26be497d325b0933827b63406ba34195802f68709e2eb86e104fd65982bd9038a445be213dec71d99360bb6e2f4bfdd23247bc71

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            1f1c3d7efb99504b2583a906898c0e38

                            SHA1

                            786ea71ed425d9bb3212cb7aff8caac93c65f486

                            SHA256

                            4fb2080b45a598d5f4aebc4a04e30045b52d2afd6299d032849e82fdefd8e493

                            SHA512

                            b98709a1d474d728547a0a789f5f71f921c7a7ad43dd9e170be344cb02e8ee3cc3c36d3d64456c7413006d2f331fcabb3df0e647a3402893936c9aa94e6e81be

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            8cf8fc1564e25fbb96241882b67dd8f3

                            SHA1

                            b91fcc468c25b69eff554b7e8a42043d182e90d8

                            SHA256

                            cfb7db2ae377d568dbdf8b118f36a93e0510271f19ba5bcf077d78f7f0b736f1

                            SHA512

                            8d583bb46e0bac6533874195d90f1e408f69dcf853b0ad3ba58e0f2c48d4e99f93697b54f0c4c8e0d3d449006258391297e66045df78526b83c734e6a7720d49

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            136KB

                            MD5

                            25c99ad385bd24d9893a22c6f5d145fd

                            SHA1

                            b910d3962c6adc9043eb601312fe652bad1b210d

                            SHA256

                            b6b407e14043350ba37788fb4f2f46ae1d764eed35e78c39b79f6c095f2413bc

                            SHA512

                            d9632c8d12336e6587ce054e7225bc9870f5242a705098e60f9c2ec992cf100197708cd4f4ccf9bdda843eb8fadf58a51c5212e22aab6ba7c603001d56f37551

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd