Resubmissions

02/08/2024, 16:03

240802-thkkrszhkn 3

02/08/2024, 16:01

240802-tf6p8azgpm 3

Analysis

  • max time kernel
    47s
  • max time network
    49s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 16:01

General

  • Target

    https://dizikral.com/

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dizikral.com/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffae215cc40,0x7ffae215cc4c,0x7ffae215cc58
      2⤵
        PID:4848
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1916 /prefetch:2
        2⤵
          PID:4360
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1636,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2184 /prefetch:3
          2⤵
            PID:1176
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2572 /prefetch:8
            2⤵
              PID:4276
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3136 /prefetch:1
              2⤵
                PID:3048
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:1
                2⤵
                  PID:1096
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4320 /prefetch:1
                  2⤵
                    PID:1952
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5148,i,883404132891317049,4841692974065881967,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5164 /prefetch:8
                    2⤵
                      PID:448
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:2528
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:1944

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        360B

                        MD5

                        84735bdcc4afd21e45444c4b0a0db6cb

                        SHA1

                        9509578a838de37c67e0c7e3c611a3bf9ba506d7

                        SHA256

                        44a53420ab6d552bec0680db7932ec3b9ea58a1f1c6914041cfbf3848819c5fe

                        SHA512

                        fa468ac79daffaab18f29e0b19309fcf2f3cefeee32fcdb0634125f98e57152e11428d24603407c5157212f5f7ccfd13214997745a38ef827c9a4edb603f425b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        fffd368e2ad2a9d9c3ddb0248dd35943

                        SHA1

                        b1d6eeafac88e9ca3abd60a30580acd13085c6f0

                        SHA256

                        7e381842fe7ac8595aa54167236b10fd49540fc7c8da6263fd665ac7a661a039

                        SHA512

                        1afe329f4af7615fe6ceac6371c75b3760f4903521ee210e2f0944cbb1bd5a939679ef96b166c914f045dd6bc8b3cf7a92401218cbe754bad25cca37114ace27

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        859B

                        MD5

                        cff52f8cda4ec0274c2a196bb3cb5a26

                        SHA1

                        803950d159a170158217f56381e391cd517b8392

                        SHA256

                        56818ae8e2e42de8962e2e0ad8cd470e611bd3beb7d1f910c42a1c4a7ba94bc5

                        SHA512

                        a8d2e070803a28233e35eea6d32bfbb210085163bf0d143e4a956d44a6193cb128940b2c657bf08478a897cf446a977494aa12b8d2cb2f43f8b73940c0dc2dde

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        8KB

                        MD5

                        8f95ddaa854740a5141ff4d0dd40f3ec

                        SHA1

                        402807be2c161805051b2e1b5d6918ed9e1fc74a

                        SHA256

                        1adaa0694ae6686df1a6ce86a00ee70def9111c9ec16507b6acbddf5dd757c42

                        SHA512

                        c5fbbc3d9743b073f56a5721d60bf6f5f1aad02804be6ae18d9988f6ff77b01eff2fe607372fef241c1a75c72881d6909cb62891fa7c6e77bb292a7ba7d526e5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        8KB

                        MD5

                        e201adfe38684e5ff846ea4485d7232d

                        SHA1

                        3cfa1f0ddc09a63dd314c215477e6fd0058f8126

                        SHA256

                        047426e1f85aacaa5f859f46dc1fd7d809b04de7d121f38dec947efaaa1a58c7

                        SHA512

                        1ab7d54f499711f5c8d83d46febac8ffe79ac53e44a005479eea0388a8f3981f1453f2ae64bb1c8b61889d64edd946ea473a643baf95cc3671149d0bfb4a82c9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        8KB

                        MD5

                        377653a4be5b23a4fce19787fa59cb65

                        SHA1

                        f101c7ab27ca0cb9b5482e12b402fb8d4eccb757

                        SHA256

                        f47a46a80f20e0461edfd04cc70145868ab64a30b61bc48085e772d0e8f6b4af

                        SHA512

                        987fc58812fdc5faba6768f176249b8f7936a90c530d3d580c6c67e09f39eb9b36a79816967c4c94f8c6c53f1fd5d2275f1ff6c4f8ee375cfc7f37cd9f08f653

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f27eaebe0fb2b2c201f6677a36b13a772e988c4d\07190846-46b0-4247-9f42-12d531088a7c\index-dir\the-real-index

                        Filesize

                        72B

                        MD5

                        f23c54300d0c678872f195b62d3acaf1

                        SHA1

                        e5db8ce0df158131623d4abf75b1533e551303d2

                        SHA256

                        f015a37a11c6645f030287268b50ec83a68d1fd8efa1269efebbc672d3c24a91

                        SHA512

                        9f04176a3e62caabe9acf586814fb19d82dd2b927a3ac2a1f25e6f0cdc8ce81a4815984f3a42e1c52d9a4188359efce49a3aed87cee8d88b860314d3c1958a27

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f27eaebe0fb2b2c201f6677a36b13a772e988c4d\07190846-46b0-4247-9f42-12d531088a7c\index-dir\the-real-index~RFe582fe5.TMP

                        Filesize

                        48B

                        MD5

                        01745b243e5743717248b21b02e4c8e9

                        SHA1

                        733f7802dc2526e65a0385a2bd65dd594fda532e

                        SHA256

                        da9583c155b52a1b4b8a206faa4e29bae2ac61c110d3468e17b6f80cf73fdf22

                        SHA512

                        c69a156be8022bdc95c1a882ef3a4674be98ed252b8d789de49fca2f530e165d915e2ec731a9d0c74e9a20d2265f9880b04f118f6cc3446f1c756f92ca85dbcb

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        99KB

                        MD5

                        d36c51373c019f91b06ca6f9af1541f7

                        SHA1

                        90c7c291322e4a4326c7ad51ee876933413fba14

                        SHA256

                        85aead68cda9549d5caa7f14a41e51cd4fb3b125210addf3292a973d5bd422a2

                        SHA512

                        6d3e4402c1f0fb59caa0ce101bda9ec9b091a6a0a6a3c9d484adb77a39414f35cf23128b6579ef22ae2fa98bc364630a852623860162c79c42b6f043a2c6a449

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        99KB

                        MD5

                        f79f3d883dd1cb5d367e8d293711c2c5

                        SHA1

                        f92387809c3bbb566b23800308d4d03b72642912

                        SHA256

                        3b9b041f9842bdb557d455bae01dc88def8278c261deb0d50d4e4d9d3c78018c

                        SHA512

                        b24167603fd9817c339fde419c673662202ba230c96d68bf0dd62d272b15ca08063b98ea1433685ddebebd9897040350d2d162bf7e6b96249999fc66aa47980b