Analysis

  • max time kernel
    1800s
  • max time network
    1698s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2024, 14:16

General

  • Target

    sample.html

  • Size

    495KB

  • MD5

    8a72518b961c31a6e773b511d327533f

  • SHA1

    e840554c2815986fbd381ee1f69ca4999e3d6932

  • SHA256

    c8644dffc2babd359ab94d7c536e0484f63141f50ccd00df2adb6c7cba8674d1

  • SHA512

    3262948a82a4b5c7f754de719af0a81e4f80f87caae89733f5e07def1e952fcbe452b3c680439f1b1e239890ef47dc1679c5906596e8c4d7e4dbbe3d573716ad

  • SSDEEP

    6144:CMUAApwApQApDApCAp1AptApXApgApOApyUb8T:CYA2AyAJAwAPAvANAqAwAXb8T

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8081fab58,0x7ff8081fab68,0x7ff8081fab78
      2⤵
        PID:3052
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1908,i,17837700109862057838,8066932869238998274,131072 /prefetch:2
        2⤵
          PID:4316
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1908,i,17837700109862057838,8066932869238998274,131072 /prefetch:8
          2⤵
            PID:1808
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1908,i,17837700109862057838,8066932869238998274,131072 /prefetch:8
            2⤵
              PID:4524
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1908,i,17837700109862057838,8066932869238998274,131072 /prefetch:1
              2⤵
                PID:4444
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1908,i,17837700109862057838,8066932869238998274,131072 /prefetch:1
                2⤵
                  PID:4996
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4912 --field-trial-handle=1908,i,17837700109862057838,8066932869238998274,131072 /prefetch:1
                  2⤵
                    PID:540
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 --field-trial-handle=1908,i,17837700109862057838,8066932869238998274,131072 /prefetch:8
                    2⤵
                      PID:3932
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 --field-trial-handle=1908,i,17837700109862057838,8066932869238998274,131072 /prefetch:8
                      2⤵
                        PID:4376
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1020 --field-trial-handle=1908,i,17837700109862057838,8066932869238998274,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3088
                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                      1⤵
                        PID:3152

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        35851375d277607738d0f54dc2108221

                        SHA1

                        9d84ab1bdd729ec5c7c879fac02883b28de2fc92

                        SHA256

                        e70a4ccc746b29324efb96d72b16b186e0e8a7461748a039805e54a1ced75aff

                        SHA512

                        b270c34b58b3d3c3c337819bd027bcc87ccad70cca99b791bb2dab449b60c985d69363ff7b7f6e3afa4dac373c836751211aac1c48ba8088202fcf3d9db80b23

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        eccdd739f6b24acce941d8cf39b47a23

                        SHA1

                        3d0200286f797317b272121bc4dfa44d256a96be

                        SHA256

                        6715e02793298d1bcb76451ddb263f1430ba63da90139c5d8746f7658af942cc

                        SHA512

                        c63ed90087bfd66eddd84536532acd8d88804abb27551275eef628436122d606593cba42f7baa9e71e8571359a428335832952059509c094eacd8826c28ed469

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        42e8125d534549afe5bc0956acfa8361

                        SHA1

                        30c3d199f6b643ce49b9850644af816bba1b0f96

                        SHA256

                        dd0df5eb260e9019ca05872c3d23bcbefdc098b4616cea93e144d45b3e0155bd

                        SHA512

                        e138c0d7d1dca066e1fe5757b7ae450bd72ba4efc2cc88d6dc3c68aaa9cb60b470b692b715eabb65e0f0ae680d357ad0f79174fd2c9436a60d3f82142cdc4905

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        b4ecb71b56cc69333b69ac8d3f25f8e5

                        SHA1

                        684b342520daa6e6f6fba0dc11118b4796f4a872

                        SHA256

                        648f156b6587190fe47672434dc5ae5b9b5df0318dba0042679a0037ec86f70c

                        SHA512

                        de05b559367cdd51364ab7651d0e295ef652bfbd17a48822d679bca0e93118a66f45c4dba4ff2da3612c8acf7b62cdd7789d374170c9a9cccd4b2bdc694232cb

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        b45023d6c67cde94f9c778efeef5b871

                        SHA1

                        01a54de97bbf0c23df1738211c12441d7795dd00

                        SHA256

                        7e09f554c64f19412c3d11040863c3d2e4b3a8fdad217a5e9a50b102bf1707ea

                        SHA512

                        92d4a634d4a0d2337c17c5d415060a2f1de28e3cbcecd75caf714d0c95431546890dab4f3eb528166fcf7a3f4e629e407b3da9ebbe7f696220872c4007a691f4

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        356B

                        MD5

                        aa6aa27a48977e2f7bdc60a20f640705

                        SHA1

                        220bb4035e567600ef261ba16a8340970cfa21ff

                        SHA256

                        edbcbeade8b869c59bb600d1318297acd71a7678c4b1214cf8e9e68fb86d5d32

                        SHA512

                        f78e5319c9fb295d4a052491a4c044aa9004a21b0c1fa8aacf08670db4a5fda382e6725fec4751caecaf38790256c50da7ad53c7ab737989e004d1a92ead204f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        524B

                        MD5

                        d00fcac69542c81ca0ca45023b1ac13b

                        SHA1

                        bac66cd324ecd50a337473d6d8ac5dd908ff65db

                        SHA256

                        1adafa905e205e1ba58172a6c8861a58ad168346d84c31e5f7f0b5d9fb2faee8

                        SHA512

                        99ecf878300b8f092520c21bfb09f97baf51128c61bcbcb9b9a82fc168d91ca1979e7c2e55e154ea884e04555d0397591da593c4cd463a18b9ab077ab321b7eb

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        a1d70a8797a1220ee6f3f201f113e2fc

                        SHA1

                        e8b5c82a77c1b34a2ea761b3cb8584684094621f

                        SHA256

                        5d05e55cbbe0c54da020293292ce82a81aca2b51624176512229c2e5fd769158

                        SHA512

                        ff86fb0a2f50ddc6fceec6d0b67ad0304ce2a7f5845844f99b6d7b271826a86096237eac2ab59a5533a6e933fd87c0947da2e141f6e0f36c72e8d7495aaf9e7f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\00f6c795-a851-4946-a30e-95131b9a7b43\index-dir\the-real-index

                        Filesize

                        1KB

                        MD5

                        887fd4ca7175cbc2650ed2e0a80ec647

                        SHA1

                        83cc393b39e45bd41f75b6d9f51bfc0cf36aa421

                        SHA256

                        9190d0b0c0b2756dd7aa4cb2e032930f71486c409ded520a81f9caaa8b296630

                        SHA512

                        037c9d777363e46cc77d4ec96fbdd93d3e7dfe7f33d3a3c87a03192dc73290310e46b7f7267475656f2b66f8f6a9749f16d124c0df364fffd2d6716e9f946583

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\00f6c795-a851-4946-a30e-95131b9a7b43\index-dir\the-real-index~RFe58a553.TMP

                        Filesize

                        48B

                        MD5

                        0275388b2c62a69f78d65b892842715d

                        SHA1

                        ae42164c9294322346e5087e8f997454feb37ee9

                        SHA256

                        11c4f805f74c2984c09781e1c80164ef3e3e0888d5b39ac0343751929743c422

                        SHA512

                        1b7ed7ff15e0dae0ff695cfd6863f60652321194c76f33f3f61d41a10f4ed7422608b7acf4306ee498a70663c84b2e1b04ad14f2919d7eaa6ef458e94b03e617

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

                        Filesize

                        144B

                        MD5

                        63f1148708c136ceebff8478328e54ba

                        SHA1

                        5c2ebc3b0fda455c029c9fe8964517453b3582bc

                        SHA256

                        6716ad2c745b1b63fdf33c484356c94edc145fc705957be3fb7feb46cc355336

                        SHA512

                        f13b017ae6d3f4672e8bb09d2dd3db44bfe900d80df09fa06d0d21eca9ef6d1dfd7c9ecedea7516ebaf6b13243946b76c24819a88149b73d61b4ab49aa1004a5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

                        Filesize

                        80B

                        MD5

                        1346f7940767e7542154fa71a1e1e29c

                        SHA1

                        60a792a01bbd77204cb106984c5009daae011a26

                        SHA256

                        7dbe148a48ce953d7360c6acce3aee9cfecd72748522c0bf4dae506e2da9d82e

                        SHA512

                        9a7392517ea312c434b837fa880a28a262b715e141b6a806c82d92f499b76c5ab30178e619e668fbe63e78903e065fc8f0c68cd4da924da36663551b356537e6

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

                        Filesize

                        82B

                        MD5

                        4771143f2212e0d504df4f75442f25d5

                        SHA1

                        f8430aabfb0581425fd3e1beb1c7d7383d06a45e

                        SHA256

                        0ea7f8b769feab7e7951154ea7316259bd52a176c4375425ecf84babbdf3b7bd

                        SHA512

                        413f3e2ab51085212351006ca4c72e210a7778ec89c7ff54bcd4814cfc98bcf4f6ce1869b44128f1d6f4157c0cacab01d7dde4a6b4c5a572c70ff51825fbac29

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe5840cd.TMP

                        Filesize

                        87B

                        MD5

                        ee2ceb83077fae1860f5e5b50d4fed9d

                        SHA1

                        5aaaa6b85964329bbf5efed94df85032415e33ea

                        SHA256

                        0024082d9683af439668fa2e59eec2c8cb7e9b1366a8ca1f407a30c8b069ca9a

                        SHA512

                        6c760156b3abec9323ef7f1775fb73c3a1b045cf3b87c60e290aa7be8537c74ddcfd9738d849bb1024b654bccec124c4dd7a42e046d948354ceb748c6a2202c2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        144KB

                        MD5

                        d32d9bba94e38c076d360ffa5af54553

                        SHA1

                        527fa81c2e340c92e1a2bcaf826bb0ad7f58d13b

                        SHA256

                        87f31e21864865aed22ccfc188bffd5290d997dbecf7acb208f36969e282bb23

                        SHA512

                        5236fc88fc938fa24ac7e4a662fcf0d4f5fc97867d814fcd24ef5a0359facc1718459acd59a3a075e6529a578c3da8ea02efd2dc260fd4e1ed618ef5e60c6d78