Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-08-2024 05:52

General

  • Target

    $PLUGINSDIR/app/cmp.html

  • Size

    5KB

  • MD5

    d7b8b31b190e552677589cfd4cbb5d8e

  • SHA1

    09ffb3c63991d5c932c819393de489268bd3ab88

  • SHA256

    6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f

  • SHA512

    32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310

  • SSDEEP

    48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95437cc40,0x7ff95437cc4c,0x7ff95437cc58
      2⤵
        PID:2980
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1816,i,2734859204736807499,8055942162606686990,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1812 /prefetch:2
        2⤵
          PID:2836
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2100,i,2734859204736807499,8055942162606686990,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2104 /prefetch:3
          2⤵
            PID:1404
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2188,i,2734859204736807499,8055942162606686990,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2392 /prefetch:8
            2⤵
              PID:4140
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,2734859204736807499,8055942162606686990,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3096 /prefetch:1
              2⤵
                PID:1836
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,2734859204736807499,8055942162606686990,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3252 /prefetch:1
                2⤵
                  PID:4732
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4368,i,2734859204736807499,8055942162606686990,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4556 /prefetch:8
                  2⤵
                    PID:3576
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4556,i,2734859204736807499,8055942162606686990,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4584 /prefetch:8
                    2⤵
                      PID:756
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4564,i,2734859204736807499,8055942162606686990,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4552 /prefetch:8
                      2⤵
                        PID:1216
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4692,i,2734859204736807499,8055942162606686990,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4624 /prefetch:8
                        2⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3108
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                      1⤵
                        PID:1188
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:5040

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                          Filesize

                          64KB

                          MD5

                          b5ad5caaaee00cb8cf445427975ae66c

                          SHA1

                          dcde6527290a326e048f9c3a85280d3fa71e1e22

                          SHA256

                          b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                          SHA512

                          92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                          Filesize

                          4B

                          MD5

                          f49655f856acb8884cc0ace29216f511

                          SHA1

                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                          SHA256

                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                          SHA512

                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                          Filesize

                          1008B

                          MD5

                          d222b77a61527f2c177b0869e7babc24

                          SHA1

                          3f23acb984307a4aeba41ebbb70439c97ad1f268

                          SHA256

                          80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                          SHA512

                          d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3b5deaee-bdfe-48ce-a33a-4ac9bed89aba.tmp

                          Filesize

                          101KB

                          MD5

                          9db064308593f4fcc0e60f491fede912

                          SHA1

                          45de253ad2db8bc4845b55323b806eed51115a74

                          SHA256

                          14173b752ad7d0a19c9ab1606df2b2b5c0f1621ca3a7cb5798138f0965c2a339

                          SHA512

                          a89515376460d86b38fcd65457ce144e3e773421d085a040b0c5a2e6c64c97fc8961e4819f0adb6488cf985545ca88c8e72c3baa7131215d4faf13be32819471

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                          Filesize

                          649B

                          MD5

                          9f86bf6712abe8a2a267c924e2a2d93a

                          SHA1

                          5829f32370ef102d4301d532e491207496c5ae72

                          SHA256

                          04b25497e6c08205f395f1249476954a7318c99c25634d766d17d806c002395c

                          SHA512

                          b7b60366d43e92386e5787e31f0cc294d6df5d22ee0fbb59f741ebe3c75f5e6dffdfb4c00ce4c0d2a4410971028684dd6aeb6c19893ae056a8f30144cc9b0724

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          a8026b81ebcee22b2b8a70b79fb45278

                          SHA1

                          d3084b0d4c082a188842a268e30669e7734f2488

                          SHA256

                          212bba65bcfdc1e9a8624061072f7c2bd631e9d38836ae15f44f3efa4a2bb4fd

                          SHA512

                          75a4c5eed88b8e8d2760ffecb0def045100ec0612879b861b11a4eb5dcc2f51f7012cfe4fcdfcfc8981fb1bfa82b85e31eba27113373eaba07b11cbfd5620b6f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          524B

                          MD5

                          e4c28dfe5904818dcc19988a79d2c420

                          SHA1

                          be17cd7681d8bd58be99f9c8be0ec1ec2d6cc03d

                          SHA256

                          74c0e18b35adf3e391cd587e76324beb9e14ff1d64c88dbf00b2ea650f723d7d

                          SHA512

                          29efce3211a37b83c7dfc1739cfc531785ffa1bedf4406b295a270fdac36dc059f874bc91fdab7c7d7eace8c2e4217ca9368809654ced382e046368a54e4c253

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          d51155f1b429d8940347febdab140706

                          SHA1

                          741c03ee3eecd3d5c154d8e000d9c2c07f22128b

                          SHA256

                          ac5ab2e41d91972d958d65d96bcad86fe56136b5007da22103d1bdc9a968cb20

                          SHA512

                          8e4c625b285dfcca8d5b1f8949672dd19e7c0696a805d4f606a68ccde67093366291a10ee161ddcaab092b1b38bf2fad2799809911fb0d55799f110d0bd64169

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          5e632ae1b0122caea4bc8806e4d3d0e3

                          SHA1

                          b4f333c19d8cec739022f1b8f5b89574d3afafd9

                          SHA256

                          17271d5b4bf3b0820af0619fa4cfb3a1b79a5291c6b630698948e9a0dfb29af7

                          SHA512

                          58c5d8d3425f05fe52857a8acbbf1a8ac73bf637f303d81ca8035d02b71d938edfdcbc2fe45d823a9736946b54d29ec90751206553658c18b5b9d18423459965

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          b44c079b60d5ffa97789cc270151db2e

                          SHA1

                          80f5bc15702e68d94636f79eca9652b07930ba83

                          SHA256

                          564527b696f5513e529826a349c2119870a59e72f7d50a90456e8aeac7bf7048

                          SHA512

                          00167346f650281f053dc8cdda2a6f7486eb09ba255daddeaa8b2723fcedeeb893a392c02a23908ebcf9d8bda847773749777a6cb060d1ad36f84e10a5d8709f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          8KB

                          MD5

                          b487f5e7cf031cc57703522623bda299

                          SHA1

                          330ce2d27a462260967503de02a1939e78f34f7c

                          SHA256

                          7ec70f2176a2374b07866ebe5324dd4f224159d627b4b2f04eceed0333bba6ae

                          SHA512

                          b99b6a277d201efd18213cc2ca15c1fd18ea6a55b1634895acb6d1b457f578128e4da823775d3f82a202eac5567c2fe6dfcb6cee93f486395f6b342bd530382c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fc37200f-268d-41c9-a9d1-8888b0b649af.tmp

                          Filesize

                          8KB

                          MD5

                          81f4e246b401867a6906b101f10d670a

                          SHA1

                          781d6006ffeabcb97f60f9dfc5645ac0ab836eaf

                          SHA256

                          5880b34c3a670e93440fa39f2224aaf0f98e0c88eba8156c6458dbd1497da6bb

                          SHA512

                          a91618d37fafb682f51af07b09fd996408cdf33432b1ec429340e6aa595956b72b2e207bc38db4d16e6e67c616713e39b9be2ca8a2e650922fa2b8ff7d8095b5

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          101KB

                          MD5

                          634dba417d973050b34f4bbdaeca603e

                          SHA1

                          751e504033451604097472e2c71041f5944dc572

                          SHA256

                          46a9c0214480975143a612c0fc6641bbe3e7d16f8e71453ac172ef92052ce558

                          SHA512

                          2f06aa389380403d2202921e525c1174102665ca425120ac59d2d3992d6dbdbb75ef37ed8f68e5d2aa6ec9d0f4392a170d561df1e0039e171122754107ce9e6b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          128KB

                          MD5

                          53802550dccda5b5dd6b48c462e23ba2

                          SHA1

                          667228e9c651fb7c200c7311c209c43173b31619

                          SHA256

                          332d50c2763ab16bca567b1fdc0fadb2c3795d15729629ef74aec07287688379

                          SHA512

                          c2827123938bbb96ee96bacaa76fa7159bee5924f714861591f0eb7fd63fc167cabf9d70fbae4043c04af95ce49cc1b4c4868b2bdfd6990b75d34ebf02b7e295

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          101KB

                          MD5

                          4243cf927cb55bffddbed27bafe39417

                          SHA1

                          88431d38aa9ec875c523ec4e5e058c80fef10262

                          SHA256

                          356c9e3391f83f22a72fcf7ca08bab1dd0d85a1396cb714b1e306dfb144ceedf

                          SHA512

                          b8288e8feec7cbc1858f49038433dca3ef051ffdff14cec04962b10a3c3e4223aaaa3171d2342bafd6a65e5a5146c5bd09e675bbc04842b9d4b7202f97321ed3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          101KB

                          MD5

                          e741bc9943f64e855d43d560e0d7975d

                          SHA1

                          d0f1c92832123306212a3a43cc441c70abe57a9a

                          SHA256

                          7b0ead2949e36738d9aa907cfa246e3383376aa0e776b83ebb70251ab5f19860

                          SHA512

                          d2108177eff34e7512ed7c15d8491bf8baf0b494c8dffe034e98f610563bf14d2043d03033f219a11cf976ddfd184be308efae3a5d0fb1f025b5c5d458c7caa2