Resubmissions

23-08-2024 12:49

240823-p2d5waxcrk 9

27-03-2024 08:31

240327-ke3gqsbe2w 10

Analysis

  • max time kernel
    1800s
  • max time network
    1143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-08-2024 12:49

General

  • Target

    196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html

  • Size

    3KB

  • MD5

    ace67f099683c4360f442c58da66aeba

  • SHA1

    2b90f1398b79331e8f853ddb004dcc87a1daf540

  • SHA256

    196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005

  • SHA512

    02e2465e10ee581b04896dd77ee906542786b7662071befa9b6c07fca00862be063516030045fb29fdec1a68108aaf93cc30db24cd329776b1d316c9d7ca7073

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ff90994cc40,0x7ff90994cc4c,0x7ff90994cc58
      2⤵
        PID:2612
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1920 /prefetch:2
        2⤵
          PID:3608
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2168,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2180 /prefetch:3
          2⤵
            PID:3928
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2444 /prefetch:8
            2⤵
              PID:1260
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1
              2⤵
                PID:4272
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3212 /prefetch:1
                2⤵
                  PID:1388
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4600,i,15122279282956413992,4134404562045083748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4608 /prefetch:8
                  2⤵
                    PID:4000
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:4156
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:3764

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      d5cfd7c039be01bada20508fdd606e34

                      SHA1

                      718b1d063ba42188eeedfd5cc15d8352cca39902

                      SHA256

                      ef13fccffd43722f4291344043d1d60baab0f250645724cf361a6f641fd60de9

                      SHA512

                      6f65083cd7122e23fdc5874c8f31b3132f4c61471d3d466a7020680e8391fd084c83beab23c7c22257f10efc5f1fa1bd5661531f35298bf3b9988b34cb495adc

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4643944e-e1e4-4fc0-908d-3a9520a7bb56.tmp

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      fa9d94c0de6b20cca9fabecfa1c12160

                      SHA1

                      54f4802d59db530b7b2bd4741037299397b821ad

                      SHA256

                      11eac5ba887d532a472eda5027eb37df8b4f1ea259069b381294aaa3dfcf41db

                      SHA512

                      4cd191d0e56d19d96d1039ec654835492c24d48138f315d8ae06023d2dee2cd8e7607bc5f65c309eee1281878109440db589f3c17d6d22fb338024c2fea0168c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      691B

                      MD5

                      a177656e078815dd336434c73a324823

                      SHA1

                      2626b60caa64427ca31155d4bd6316743babe51c

                      SHA256

                      574e76ddedf5d54bb0192d426b4eeb85c091bba030a5d552ffd2ef74c1f08acc

                      SHA512

                      4f5ebc50307f36a8a60957de32411809a964a968d0e7de2b30980fd2e530db5aea09e64f8df1dd5ea2a9b3c2cd2909e56016778dc40ad13a4648254b4bbf8e7d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      0fd6018416f4ea953da8b5df39a6772b

                      SHA1

                      e9d5d4d6e01cb3a855b26c4047ae8c1ce31bbf61

                      SHA256

                      ab15da05302f403d1b97a7c224a03b13f5540e411ecbd0d5fe689c938f6b466f

                      SHA512

                      a71b027193329ff203d6413908e4c3c4476935cbb44b381c414a9cae3842b44ba29f4dcc307f90b2f33c75ddfea2d25ffbf92e4dfa147b4007e989f58d2e47b3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      8KB

                      MD5

                      eca4e43d0291d6cbc4f33a9f62c72ee2

                      SHA1

                      99956e0b065206369b748b957387f79d13bfcc2b

                      SHA256

                      4ee2015d1f130f0276982e23aed5fd81ea9bad2e69061466783363abb1be83a6

                      SHA512

                      1402e656dd0c074f31a3eac84dcde5a8da78e46376afd8cb5d1b8a4667642e6a82284144b2a98ba01c841fffcacd3cc26ae540d896aa9a36e555c33ab267b975

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      8KB

                      MD5

                      d4895a5ecff3c35c4f9524295f0a704e

                      SHA1

                      681c7dcfbbfb8f026b0bdde752cd38d1f89d7cd9

                      SHA256

                      e1e07833d6c3296f7582383cbe3e3e1e03bdc552854ca1d1870430fea4d1f7da

                      SHA512

                      8822746d6cf6f19daf280124e6e213a1e4fbf0535540304b470c5c724a0264837bd98ed3c80f707280ea9cfb7d9cf56f6236e085d8f188370492c9ffdd4150a1

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      ce7da4abff40e6429f59608017b69aa8

                      SHA1

                      65f400c4b8e7dc88611cbf662c1d623dd3c428ae

                      SHA256

                      1a955941b9f70f2dc233e3df4d6ed0ab14580fad112dcab4d9af585ce983521c

                      SHA512

                      0e9fc657ba7fee270756ecf0867033624d538c28f3c83331acac6214c8962ccdb9c7fdc5c449699d67462db9a39bf2f52ed13cdef20e5749ebf0dc1ae544bda4

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      99KB

                      MD5

                      14e278dc1a0c3405f3a854b4ce7830a7

                      SHA1

                      1186ce1d47c3d74f2afea10531a2611fb7db5198

                      SHA256

                      4cee4325e06b74c990cb9c5a12a272349fb512ce0452c8f586e0535987a99398

                      SHA512

                      fc4f2b5b6f84c6babc0bdc4e88e893e119c75ba3b5c395e3dc864f981e3a5086c93df17503e788ee84a867a3027cb9ddfb14116672b483bbd41dab4f90646abb

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      99KB

                      MD5

                      fa4bd5d8221e211be7d2ff7e5381faf0

                      SHA1

                      8c0a4f0c4c1b46ddbd15441348e50dcbb620c222

                      SHA256

                      2f2545f0b6ef280f7ed8d96078bd03b0b5bb284752207dcea560ef8d181fc571

                      SHA512

                      6fa16956f68a57e0251e4005f59e7669d112c3e7a905107c86126895229399c69811c4e9dc63de485e52342e01bf340cac50f75484756fde7011b1c0d71a50d7

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      99KB

                      MD5

                      1e83dee435334b8c35a0602319cfdbd2

                      SHA1

                      3cdfc0843cb1f704d11d046758eb95541e0f4f40

                      SHA256

                      c510ea6f041c5974bb110749a68dd641d1cb6cf27d7bdd225a429ba7dccd98a1

                      SHA512

                      74c33315950b2d8df5170b9c86720e5ad4fd1365064bb27bcc6cb9221d906f7e7a2a7736e67b17b02f386fc7feaac29dfca23812ca614f3f5fccb61e667a63a9

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                      Filesize

                      264KB

                      MD5

                      59708af2851eea33b28b89996cf97f4f

                      SHA1

                      37ed45df69313cf33882440b8dd90472309071bd

                      SHA256

                      6ec9b0be0d24e9022a9f7f4d86032d08f355faa1ff0ba8142248c851797fbf90

                      SHA512

                      a4e3fc137c74c8fbaf6fda567b868598a091f9ab6344444c49e97b73402a0bcb7d35b28bd7326c586ba9e4a82258bacbe6c4f64bfbea59c699539c38d96a88a9