Resubmissions

18-07-2024 18:20

240718-wyz2ha1ajp 3

18-07-2024 18:19

240718-wyjphszhqq 3

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-07-2024 18:19

General

  • Target

    Domain/bin/assets/ui.html

  • Size

    4KB

  • MD5

    6f8f041c68e7bc0067d7e6e4c3e9b824

  • SHA1

    550b684e7e03154f5424271e97a33c1ada49d5db

  • SHA256

    fbe5a564a1d50db2341cfd339f7feed965024c18ffb916fa77aae4651fa0e5ea

  • SHA512

    88ae8526d6874f7480224672ae4a7e2557699f0423ef6f32dbcc68f0207a2ec0fca70af60e1bc8ba19c100f46d0f93d19b203b63a03543ee3289857a1e9dca3c

  • SSDEEP

    96:HMA5Xrg16dLUWUU1MmUtJ9zYz50yZ5am7ZCpvMAEHIVzaGOc:HMA57g2LU9UamU/hkVZ5EpvMAEoVuGOc

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Domain\bin\assets\ui.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa5f7d9758,0x7ffa5f7d9768,0x7ffa5f7d9778
      2⤵
        PID:4116
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1804,i,14744263083992933071,2679907545985450025,131072 /prefetch:2
        2⤵
          PID:484
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1804,i,14744263083992933071,2679907545985450025,131072 /prefetch:8
          2⤵
            PID:4456
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1804,i,14744263083992933071,2679907545985450025,131072 /prefetch:8
            2⤵
              PID:4112
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2836 --field-trial-handle=1804,i,14744263083992933071,2679907545985450025,131072 /prefetch:1
              2⤵
                PID:4536
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1804,i,14744263083992933071,2679907545985450025,131072 /prefetch:1
                2⤵
                  PID:4608
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 --field-trial-handle=1804,i,14744263083992933071,2679907545985450025,131072 /prefetch:8
                  2⤵
                    PID:4560
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 --field-trial-handle=1804,i,14744263083992933071,2679907545985450025,131072 /prefetch:8
                    2⤵
                      PID:504
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4348 --field-trial-handle=1804,i,14744263083992933071,2679907545985450025,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1412
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:380

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                      Filesize

                      1KB

                      MD5

                      4843d25f486912d2febf58691edbf0c4

                      SHA1

                      85e42a69dcd62123dc84f171a7979e104f99ae64

                      SHA256

                      142075426c3bec6d00eb6220c919f665cd722db36efb9620edfb2b7663eef92d

                      SHA512

                      d5ab4af1f4adf981e7ab02c76427609588cefa7b7fae1d41367b0e3c925a1a09a550a321fa3bce453db93ed2df83456cc556e4e793b7eb12fd5cf0fd5e1d5a4f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                      Filesize

                      707B

                      MD5

                      d58374f095c6e4d2e345b398e88df5f1

                      SHA1

                      9e1a04020a24ddcec6630d4cf1fa32554a35378f

                      SHA256

                      1b24298bb1f69811744eaa3b3fe770504c3ec92c936b549a8ce22a4898e81dfe

                      SHA512

                      5f38c422315c4c6cb71c15a40bae85f29aba31a14213bf68df410c38e77e94d067f4b22cb5efe98ee7816e4e72b376e65abd00f2b01e843694938428a5526d73

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                      Filesize

                      5KB

                      MD5

                      32e5f4e04d5a5a200828c0dc3f15a17e

                      SHA1

                      d433502a9d329b7bca36ffbe17e5fc1250930717

                      SHA256

                      169d2811465e6cbf74e79a412d51cac51682491d3278ea7c0202f9bcaa43e438

                      SHA512

                      8e031c666434a2e4625e503429c4ea3c810cb6e4c8cae8a087f942557372e6833328c076ce1a4d379ae0b4e6e75843b151111bf48c0cec1e847b06ad73e233e1

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                      Filesize

                      5KB

                      MD5

                      567bd638fa8476cfc7b10c3ade7b3d74

                      SHA1

                      ca8481c9dae251d85902736aa90b7052412f4cd2

                      SHA256

                      ab0798e63ee0376171893ae7e39999be787403d6d854371a628e9d64eb96b98d

                      SHA512

                      98c302e469ab32ac3afabfd300d9e1f9dc446a3706d376179efd0e639ce3cae498ce5c91d7f012639f863a6ddfd644228843e6519ff86c50699874ee933fe008

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                      Filesize

                      5KB

                      MD5

                      d02ba32a86d1de54a9c39fc302b9002f

                      SHA1

                      cb706cd1817d64168c118d4195b332fe5a4f01fd

                      SHA256

                      ff18366de8ce15c827f53612e7bdc192e74192c19c961d1eeec13a8d06f836bc

                      SHA512

                      62e52167d34840b407f69519124f5ef2bad236bc8b2ca3da008a4056738e071d26258c9cf1f4aa56838d9d647c39c89b7e71b65077f5f283f9aa165a87c48e50

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                      Filesize

                      136KB

                      MD5

                      2289b5ff9c8a785103073f91b54736a4

                      SHA1

                      aa5197a0ede626f640213abb98ed52f50a6071d8

                      SHA256

                      2ee9326fa43dffc1a284fd27ba995c1af51b3386a952c9b56f96e8cbc9568da3

                      SHA512

                      a915a04b87a9b0c24c80891d61c1c425a244f9bcb26410c1f34544550afadcd6609911964d33f7c91d194ac3d79e4b2e2ea3446a1d0df7c9bea1d0ffa1aeeaa8

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                      Filesize

                      2B

                      MD5

                      99914b932bd37a50b983c5e7c90ae93b

                      SHA1

                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                      SHA256

                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                      SHA512

                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                    • \??\pipe\crashpad_2676_KBCUNLPLAUQEGOMJ
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e