Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/08/2024, 22:21

General

  • Target

    http://143.244.153.54/

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://143.244.153.54/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9298f9758,0x7ff9298f9768,0x7ff9298f9778
      2⤵
        PID:4832
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:2
        2⤵
          PID:2064
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:8
          2⤵
            PID:5084
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:8
            2⤵
              PID:1828
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2732 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:1
              2⤵
                PID:4844
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2768 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:1
                2⤵
                  PID:3280
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:8
                  2⤵
                    PID:2244
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4308 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:8
                    2⤵
                      PID:4620
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:8
                      2⤵
                        PID:4652
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:8
                        2⤵
                          PID:3392
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:8
                          2⤵
                            PID:3544
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 --field-trial-handle=1800,i,8781706526911732948,17525394098052003711,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4852
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:4868

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  0a789e02996e88503a38d3debd5d0568

                                  SHA1

                                  e1f019e02a50eaf86e712688d9ab002b0f45cf3c

                                  SHA256

                                  994e632f8171093edc61b2ebb6f6bec634ff18a7556c1d1e3d294bb2ad2aa8b9

                                  SHA512

                                  2810cebcb1ac2b5531aa2ddfe05bf9df96df6ddbc5e7664008850a871f87c92b22b194895f585d8077a1b0ab03514a1e086ede69937dfc4ec675b389a7003427

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  c4bfe19aae7c9eee5507887a407ce234

                                  SHA1

                                  0fa81db7913333e27f7cdd4d011d27bf89741749

                                  SHA256

                                  037d1cf5b658789d0477dca764ed5d48943b0cc3f60a0e0e12c22dea5709bc75

                                  SHA512

                                  87f51fba0b924e147082aa2b67d5ba67ac96a091a805ea10a5528c10df605c47662c569f7cc6ee8e628e119b80bed45f3bd711c23b78a37364981df3d6b5054a

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  20bc65c8739fdd27e960a0556b0560f6

                                  SHA1

                                  256d714abf4e619d11f38a9120e2947c266954e1

                                  SHA256

                                  75d5eee74ec2c7fa6f357f06e8aa3ad00c55e1b9c7e2473dd2d2bc9fad1f8fa2

                                  SHA512

                                  1fe2c7d8a207c43056f710b0b26f87cd17f618ad5a96f765b52517142483ed736ea28b5385e42509c28c753316254c5a6fbbdf0dfeb26179580927712daab0cf

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  150KB

                                  MD5

                                  adaa84684712573d124077fddfc2e302

                                  SHA1

                                  0eb339d70e95dcc49f3b756808b7bcb9f0363325

                                  SHA256

                                  7a54e0b593ab62ae1c25763513196f9021f612c7ca4877f1887e9e8e0e5e6ede

                                  SHA512

                                  0e3d4078146f289c69b2c4b3223d6ce535fff984ffd27c0e0cc475b1fb8e9943525ba99fcc32c82b930c43a3feb28ac67abfedb45536d9f0ebb585e0cf1d14b7

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  167KB

                                  MD5

                                  4c0e61f708bd4525882b2db339addb8e

                                  SHA1

                                  45b57e9faf913eafe526c55192db7875027bf471

                                  SHA256

                                  1415c2849027ba98dbe6815e28920c1e1463b386dc19624364bcf5f0f96fcbdc

                                  SHA512

                                  d29d6406e6c6e0ee705e1aa38ac4936143366b15ca3d4a5d90aca8aa801d0c009bb618f820398eafb475d1a43e82e4f982cc185545486fbb50088e70ea4db8d7

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  150KB

                                  MD5

                                  7401ef3f80676a784768a1fc421dc5a7

                                  SHA1

                                  b69f80f2d4c43114dcbba984b320aba81da0a58c

                                  SHA256

                                  a3cf62d819b966dcfe083a95914fa8e838ad9b27ab3a1e1c79c40e758ef3d1f3

                                  SHA512

                                  b3e5ff505513e92a5b31697a3aacb360739b4240ce5cb2f602e3341886f4fae5263c3379187259ddd7a0cd5b248857530e7e7ff5c79d1de3ee3a45d680290931

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  150KB

                                  MD5

                                  cfa32abab2e6796015733b28abe6ed61

                                  SHA1

                                  d2ac8fa051bc3c92d720fd7e770ecb0828c64e66

                                  SHA256

                                  690e61630c893685abac1f692696996fdd8ec37cd39665c219d12c829944d1a4

                                  SHA512

                                  94f028fa4b85995f1df368d6c244f48e12931e51bfbde84629fd42defe1fd51022e6a55a86c3fb6cf0a29c2d8749c02bcdb7d529d21bc9910e0f32e48cb4bc32

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                  Filesize

                                  93KB

                                  MD5

                                  89b972ac762fc8e629dbd4c229b8ec47

                                  SHA1

                                  d3cec2f93e388b84f57ca961898595ee4ee25f0c

                                  SHA256

                                  03fe411bbf8aa00219a3753487941935f686b9f04ea15d5abd162be6648000d9

                                  SHA512

                                  70fed7e9bf6bc3cfbead15189799319958c483d0bab489e25447f3b1546ad961f9c79eb7bcdaa2c7c48d7c20ef066cf83b4a349f26a756cabd75caab45f339ca

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58eda7.TMP

                                  Filesize

                                  91KB

                                  MD5

                                  20f106a13a8ba1973f0db56590eb4532

                                  SHA1

                                  53c763ab8e19e2d7c0f24ff2153b274667b75669

                                  SHA256

                                  5e24d0a54b7101298da9931d8ba2157946a4964618844ca7505c262776ced83a

                                  SHA512

                                  245b4718ec36a48bfb38c60da4d96d3c9d44887b0bf8bc6ccb64399bb9a6a6084ff9ca6b14bcfc471de9f194b7d8cd3a30639818588a703700044d6a31812687

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd