Analysis

  • max time kernel
    59s
  • max time network
    60s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/08/2024, 18:30

General

  • Target

    https://www.wireshark.org/#downloadLink

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.wireshark.org/#downloadLink
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff0e6e9758,0x7fff0e6e9768,0x7fff0e6e9778
      2⤵
        PID:4876
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:2
        2⤵
          PID:1336
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:8
          2⤵
            PID:684
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:8
            2⤵
              PID:1260
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:1
              2⤵
                PID:4884
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:1
                2⤵
                  PID:2440
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4316 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:1
                  2⤵
                    PID:2496
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4624 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:8
                    2⤵
                      PID:868
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4392 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:8
                      2⤵
                        PID:1344
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5312 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:8
                        2⤵
                          PID:368
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5380 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:8
                          2⤵
                            PID:1020
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:8
                            2⤵
                              PID:4728
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:8
                              2⤵
                                PID:2672
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:8
                                2⤵
                                  PID:4616
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 --field-trial-handle=1804,i,18081414957074089408,9618988001332203316,131072 /prefetch:8
                                  2⤵
                                    PID:4528
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:4068

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

                                          Filesize

                                          32KB

                                          MD5

                                          9c14da42e50b2e167bec77d3ea93350b

                                          SHA1

                                          3134a533899708740220acb3108c47872e792a2c

                                          SHA256

                                          32836c50b4c42baaddb764ee10a9a895865ccebc9eebc66a3f0d47ee09131b4e

                                          SHA512

                                          f93dbf35d425a25ff4285228eeae0b43dfcd93a368d5a27cc8f4bb80759da8ecdcd26facc2d00722c8b3131051558747fbb9625113b161cc6253a7fa9fb8b3a0

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          384B

                                          MD5

                                          febc72203e725d46b5eea7002286e053

                                          SHA1

                                          70800b9caaa17865daf0a71d81e5e93012d42230

                                          SHA256

                                          9913bdce4a3a7d6eced129441977f0b67de724b688c9f932ac3f7673e8e96d93

                                          SHA512

                                          e03f91bd8e08d87f0d53b736d31014503c37f1c08a458afa3b869f3df13b87dd4f6380d3c8441382d6c539c0a65ff891229959b4e58e352cefe40541d957545d

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          871B

                                          MD5

                                          5c71c33ddfde0258c7bf7a065c113184

                                          SHA1

                                          a4770e7771fcf5cc6f51353b0552943a402ee3f5

                                          SHA256

                                          e2be17637b987226a678e2b7eb4ecefbcaf99ef49a5dc3d385a59fccbd7da1f7

                                          SHA512

                                          c04bca31c63e2ee1d46dc8a703290ed6ac8e3cb7ad3606b32d030bf1b002f7000765d68cdcaf52c2c810c9d012961c5b872eace1ed6c2d5d5063fe78ad1fbf74

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          fe21daa3d111e21c8bdcdef015dba606

                                          SHA1

                                          faddce2a418c0362490936acae36eeaf18ada29d

                                          SHA256

                                          ff260747e98775db3917eb633d111f189e6b9408384e5f89cea2070e7726194c

                                          SHA512

                                          352acc609d4ed4af726cc7c37a02e9f45e51345e1cee38cb223bb7d9ec4d46a589085c60eca5b74c32301d0682953eda2926f3b1d50c86322d4f86aa66360fc4

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                          Filesize

                                          56B

                                          MD5

                                          94275bde03760c160b707ba8806ef545

                                          SHA1

                                          aad8d87b0796de7baca00ab000b2b12a26427859

                                          SHA256

                                          c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

                                          SHA512

                                          2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                          Filesize

                                          120B

                                          MD5

                                          ad3e6dbb795d7859a25ec27597ac3291

                                          SHA1

                                          94fdeae34e5e7e2fcd0fff47b973998287fc2699

                                          SHA256

                                          d27c828a62d6b0e99e3b442ea587580ab21c75dbee5661bd44f19c5ea311a6c5

                                          SHA512

                                          c1d6d38403b7d884a9bf819b0b9c35bf912b062c16748d1866a8cd7b61f37c1c7df5cdfa745865d3d68d1079ed3e8da06a2e937aecb765d06783250ad6680e44

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57800d.TMP

                                          Filesize

                                          120B

                                          MD5

                                          57906936600dbcb8394c6322e6a25a45

                                          SHA1

                                          9bed9d7d72ac97e04348e3c99d047529462eca6a

                                          SHA256

                                          4c1d51f4d303a8988ab794f51cca1738a4eb7544a2398c7b0ae216fda1e570c8

                                          SHA512

                                          f74237efc7b6a55851182271e089be0d877d4129902b3c5c113a7c7234efdd8e0fa25362a6f3b0559a78eafdd47871dd559243117e283ce0ac9e246873d4eebb

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                          Filesize

                                          72B

                                          MD5

                                          1fa9c87fb62205b8409ae2306015b894

                                          SHA1

                                          32f3de7609a4f4042a561155d2d14e11b6094eff

                                          SHA256

                                          ccfe17525c495dce9132826a5e8ed4f883c29228a49a8287f0a79c706a6527e3

                                          SHA512

                                          cfd0dd76f6e1ccb8867ab60a72fbb393c6f523771ddca8df4cfc4dbe20dfb70fdfc5c9b0c3ac055190c11833f8fdd30c8d3974ea76ee9f8d7e1c8c335593629f

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c96a.TMP

                                          Filesize

                                          48B

                                          MD5

                                          6b026bf1d6fe50d04135ae4c4a9d6d80

                                          SHA1

                                          b7070a4f4a887969f5031eaee60546242fe03c4c

                                          SHA256

                                          13b2f500551a3d28e9d629186524f0fc0fe44401460a3d300df7efa78c3fc21c

                                          SHA512

                                          e6c4c99016d0ec845adeb7b78d185aef23b86eb71efe78e4cce12b73b3b97a1bb5298ff4cb1740b1a4a2872316f3000b2010e900a2431eb06a379beedfcbfd30

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          137KB

                                          MD5

                                          8b40fb0616cbf594c85316670592928e

                                          SHA1

                                          222fb5c9857e5259106da9f762569f14bfa5597e

                                          SHA256

                                          70830f25c51811da31d716df230e92e7eee3c12d9982a72001790346574e7a2b

                                          SHA512

                                          908b4cb3994311dd665dcbf35e7329ecec7f60d3de7dbda390dfbe0a5547be31b857176ec48873c82f2f7b6c9a69cb70f37c29318165d04927df411332b670c7

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          138KB

                                          MD5

                                          e3654238cf0dd99e270661d8461ef7bd

                                          SHA1

                                          b11549d755cb17ff9eb91fa450c06770e9c63ecb

                                          SHA256

                                          53d022f5c3aec280bb064f7dd2c2d341fb2051301739a3860372c8e51be092a3

                                          SHA512

                                          18447f6840a4ea62fec93a61839494c474a26593ceab63c6f8d06495bdd2b8df9af4da402dd6a2ecfaa6f7c8f896f0f4d94d8c5c464fdc7064b31f3b8693660d

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                          Filesize

                                          2B

                                          MD5

                                          99914b932bd37a50b983c5e7c90ae93b

                                          SHA1

                                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                          SHA256

                                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                          SHA512

                                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd