Analysis

  • max time kernel
    122s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/08/2024, 23:50

General

  • Target

    http://aceks34ke.cc

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://aceks34ke.cc
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce1a3cc40,0x7ffce1a3cc4c,0x7ffce1a3cc58
      2⤵
        PID:1712
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1804 /prefetch:2
        2⤵
          PID:4992
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2036,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2092 /prefetch:3
          2⤵
            PID:3332
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2152,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2328 /prefetch:8
            2⤵
              PID:5008
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3008,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3024 /prefetch:1
              2⤵
                PID:4092
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3012,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3152 /prefetch:1
                2⤵
                  PID:3284
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4116,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4124 /prefetch:1
                  2⤵
                    PID:3740
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3152,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3164 /prefetch:1
                    2⤵
                      PID:4816
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4700,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4720 /prefetch:8
                      2⤵
                        PID:4968
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4384,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4924 /prefetch:1
                        2⤵
                          PID:4504
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4764,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3264 /prefetch:1
                          2⤵
                            PID:2808
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3292,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3320 /prefetch:1
                            2⤵
                              PID:2316
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3164,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4544 /prefetch:1
                              2⤵
                                PID:3040
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3124,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3076 /prefetch:1
                                2⤵
                                  PID:424
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5212,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5204 /prefetch:1
                                  2⤵
                                    PID:4628
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4336,i,2847571963862172111,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4908 /prefetch:1
                                    2⤵
                                      PID:2380
                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                    1⤵
                                      PID:3512
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                      1⤵
                                        PID:2352

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                              Filesize

                                              649B

                                              MD5

                                              9ee8fa57a7d36fac421a9937644faacf

                                              SHA1

                                              f2d0cd08f3225c7eb5776a2778f7e1d784c06f98

                                              SHA256

                                              a4e8a8d9d09c33b8149126cc693d23c2a405ac4702feda5f37b99fc167121d95

                                              SHA512

                                              7c11bdd4d423466d8e15a0b7520e4b1fd1fb4b64d953805966121519272f9d8cf89596e8c2b9aae43bcb9de5aa11a3f6deb48f77633689190b15cacc12734165

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                              Filesize

                                              210KB

                                              MD5

                                              48d2860dd3168b6f06a4f27c6791bcaa

                                              SHA1

                                              f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

                                              SHA256

                                              04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

                                              SHA512

                                              172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              216B

                                              MD5

                                              2822a10cbc898b1d47af743a4ab12712

                                              SHA1

                                              0ea7ba7705e23fb41b62f6d2c3595c18b540cf0a

                                              SHA256

                                              1c681a423f88c99bf6361a61d0c07e29a69f48a4fe4ef05fe5803a2a4f6e2854

                                              SHA512

                                              396cb210dd676f3b6c8029cd184330d180b3f329632f304285344ae815c5021f560c07bf163f6d3b296574e73787928bbe080ff61eb24f2aef7c7bea3bb25ebf

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                              Filesize

                                              2KB

                                              MD5

                                              61abff1a6de95a970d81cb42ebe6a161

                                              SHA1

                                              e8ebe5a42a8dfb46ee88db46bd19e16bc74a4178

                                              SHA256

                                              f09fa58de3c79772cf75227096137c7b38bcb0f16be4e2a93dc454f8087e51b0

                                              SHA512

                                              e056974cbb801fcebdd0d634a6f8a7894ed61e7e55add32792d7ee532429c88414afbd9143cc85e2250c2fd6b6bf2f515f2b38b713b179a96e36da21c51a0db3

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                              Filesize

                                              2B

                                              MD5

                                              d751713988987e9331980363e24189ce

                                              SHA1

                                              97d170e1550eee4afc0af065b78cda302a97674c

                                              SHA256

                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                              SHA512

                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              354B

                                              MD5

                                              e0baf0997a732db887ec4c55f5e2fb48

                                              SHA1

                                              147d95b78b3cbbad611696d5988da97dc7c41d81

                                              SHA256

                                              c894c8124cc083296664a8bec5564510a1cd5e0ed61df9bec8d34d211ca7ce55

                                              SHA512

                                              c132ca5252594df608644df47a11af08f5a0209f27e04e337bdb979387a6a204b31bd4f6f27110fa3ff663b46788c17f3466a5555c1c1c7484cd00976da0ab82

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              9KB

                                              MD5

                                              f5943129b50135d087f9038bb97528c3

                                              SHA1

                                              4591c2e274e39ed6cbdf01c2e665587c7b7c73af

                                              SHA256

                                              ea949049e587d1aa4626afc57be054ccc9fe547e8aa076f243c85ac14bc5932a

                                              SHA512

                                              3ab460776e6584d5b964d71c76a15c338fe030cb63ce1153bc3ff4d5d2a205327c3a78017d604a323ef9f6b61ada077945792c1e86303c8bd794d65968d54419

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              10KB

                                              MD5

                                              5a072d1dd28f79b3f7801320ffd1a662

                                              SHA1

                                              1f07a0f77581d9334ffcf705cd66c55f1662d927

                                              SHA256

                                              b31f7ab672ab08fdd437f8c3b2ee7c5b2b1930c6e71fac45763beebcc49e2cd4

                                              SHA512

                                              cb08813a0d031193a76ff3248f851c2f199b3b18e7a016a12e8e9545168127d672d6d54fc2f7f6542965d3f28e2c303cc6dfc0e41369da72dfcc9abbaf748506

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              9KB

                                              MD5

                                              03bf665d954e06b08239d1387e313e59

                                              SHA1

                                              b4dcf90e6825b8f3fb6ce31b5ad56dbab5ca5855

                                              SHA256

                                              1c28571852eeea8c11f809d9e5e4f351cb977c001f441f0b895c26d976cd0825

                                              SHA512

                                              759ad26e0285eafe4b008c24085a4b47fc53d4998ace333ae66669157604805d2b441c20c35b46124e9571ed1017ac63bcb3591b345d303fcd335b2e5d5cd09a

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              99KB

                                              MD5

                                              201297c5a58ba1da0769850f0b17b7d5

                                              SHA1

                                              3110d86a65b1ba3407e650e16dc0e3bf5d890aa7

                                              SHA256

                                              1abe129e1905250a195505e0e4df651c36a4f5c48b1506a8b7b3bc609d629c90

                                              SHA512

                                              c5d0a7ee240478ead859cc33420aa1fa9a161dc37d271dea90576b37b35d7af40472254513c85a1e192deb1a710c3612e7f882b6837eb78282c970710326bd6c

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              99KB

                                              MD5

                                              0e2b0dc0f1b0680f90c499d82d76ae7a

                                              SHA1

                                              0b0de4e29e68c7e4e349158f106fa596fd6493ef

                                              SHA256

                                              798467644ac42d7ff62fe6a07bb93c27146110499f34590046bfba27fe67a183

                                              SHA512

                                              c4291ea8bd170ab35bfff7745769319fd31ded7b098eb68fae45052f72d7b3b5a188ef3f81823a54811c69a5240296093d867d498071e6036b3d113672bcd9fb

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                              Filesize

                                              264KB

                                              MD5

                                              d32863e26c37af9bf5d74876d890d004

                                              SHA1

                                              d116ff0862ff5a48e366e43996fdc974564eaf30

                                              SHA256

                                              4f11f04e0cba308ffd26b451bc72af20c6af23f81dbe357286a2fb0963daa2f9

                                              SHA512

                                              160642629620990d70e0db772c217ef9dbd5441693119fd3e541362fc0b269834c7964e8e6738f837cf279fad75eb17bac5b81cf16035e5a8ad60f88ae5b79b8