Resubmissions

19/09/2024, 04:11

240919-esae8azgrc 3

Analysis

  • max time kernel
    30s
  • max time network
    32s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 04:11

General

  • Target

    http://jpllogistics.com

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://jpllogistics.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4668
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff98354cc40,0x7ff98354cc4c,0x7ff98354cc58
      2⤵
        PID:828
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1816 /prefetch:2
        2⤵
          PID:4016
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2172 /prefetch:3
          2⤵
            PID:4844
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2436 /prefetch:8
            2⤵
              PID:4612
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3060 /prefetch:1
              2⤵
                PID:2924
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3064,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3096 /prefetch:1
                2⤵
                  PID:1700
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3688,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4472 /prefetch:1
                  2⤵
                    PID:3736
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4660,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3332 /prefetch:1
                    2⤵
                      PID:1832
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3300,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4728 /prefetch:8
                      2⤵
                        PID:3476
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3328,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4824 /prefetch:8
                        2⤵
                        • Modifies registry class
                        PID:512
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5012,i,18332906910498551272,3180977685625223508,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5024 /prefetch:8
                        2⤵
                          PID:516
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                        1⤵
                          PID:3580
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:4784

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4c089c5c-f360-4618-9c6e-9139bf48b47b.tmp

                            Filesize

                            99KB

                            MD5

                            b71107f83f15ef8dc711a553dceb60bf

                            SHA1

                            0fac2b7dd54e98a01244727ffcd2f5a7c801ef99

                            SHA256

                            622329c4f7600baa53ad085f4f14ec45c180007f2df3cc19cff739141e7389d1

                            SHA512

                            d09a733901e289214484075d7df4cceb042a3f4c5c29a26672bf53ff228282e86e07d9fe77d584e300caeedec836147bd3cf17cbdd3e042c76258ed8c75f6600

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                            Filesize

                            649B

                            MD5

                            57466031453016041c89dd7b37c9821e

                            SHA1

                            1a99690b1f95efbda0e8dfc8442a5516a38aa000

                            SHA256

                            2ebde8c1065423f4dcb688e6a8137f0045613c885ddc4a4e5084465525aa27fa

                            SHA512

                            6ed3e6dbb696912cac12bb6252523a0687772a766d085f036a18bec79cd6c764241fbd247a675583f8222fe1c04ec2fa1857f3abe6bcce5cf326207f64489330

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            1008B

                            MD5

                            a5211c747f2559dcaee0dde0023c12c0

                            SHA1

                            86dc31dc9a937f8f94fb43c440d37a1f20a706f9

                            SHA256

                            4cc7f43f4a82a9f8c9cd5abb868551a0ce5bf0bec5415509fbf6e57894198532

                            SHA512

                            97698b2bdbe83ac510a140768d900279225f8603ae16461fa5d8071606e67a1ea608a47a7c1c491ec93c50fe4bd06fab74094329093bffae7191bb86c093faa5

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            f2113a7132e4f7880735bc5b6cc80428

                            SHA1

                            f0237c5962e82f2a8c3220f23907363c6b2f4de5

                            SHA256

                            4d58033c5781781021eaf00c9cafc0965bc06817e81469dc064461ab18acc696

                            SHA512

                            3b50a43402fdbed7739d9e9b0897846acc610fd67765e95d5d289f80fedf61c31e2e9f6a7fb220c634218ba0e41f73cfa109626c4334b39777d0b8859bb32d66

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            692B

                            MD5

                            4ea790df98b81ad069e543a4c3f2a4fb

                            SHA1

                            910dcf4a38565e31b18332739aace168e3ac92b2

                            SHA256

                            85902ce3ade3f726e76388a7691512621df0a506d32a36838cd55a9a05b5d8f3

                            SHA512

                            cab459dcf2ad62742428ac12b244efbbabb1d0d1b75fa173596221589a34d31fe53f4fe4f07895c4e79da03a665f2772f8cb20285ecb9ff3bef6bf29f49d92c6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            26fad762cc0d41390bc5164c43096092

                            SHA1

                            28fe51878433eab9ccbde8f6cd3ed3df339d4511

                            SHA256

                            96ccbabced5402570de9b836998e536bf6829fb083cf7df23b6ff8f4e71efd1a

                            SHA512

                            ab9d1d2db0a795b01b9ecdd2c32a61725fc24da272f17aff7f6636a00df4d3150800de8ebc5d3300a5c550e0c93967007bed6f695f77a17193393033f4499e76

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            94a47adc244dd08fb5db4c8a42b5e4c0

                            SHA1

                            fe407ab86ee300e03c120fb07c1df927620d6f98

                            SHA256

                            b5274f5c37786abab37b5184ead2abbac5ec68194809b66e640a32f09a70b3ed

                            SHA512

                            fda1b5542c88bcafbacfb420afeb27fbbce6546923de5a46fa1d45e7c231b90159ccfee011dd731e47344be837d5a5d4f810ca80a370ac823a365d02f08fcd97

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt

                            Filesize

                            82B

                            MD5

                            e1577093727e92f29011cab02c3da7e1

                            SHA1

                            8f8c333f87ac7d4cd6dc2be2fe4837aa51ca1c59

                            SHA256

                            c37b51e2782433ee2cc0fa006b98a58eaba954f7627761df6ca36ce1fdf6bbd8

                            SHA512

                            67f6bc700785fe5cccb429d566e9576dfd0a1049273dc4a3316c510f84816eaca91c330ff251f63b543078bb992478b3d82a26f929e4fff79ed60d977d2cbbae

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe57d32e.TMP

                            Filesize

                            146B

                            MD5

                            2e98a65d9e9ead58b5b1ecfc628575e0

                            SHA1

                            87212d8679260cbc6b9f29fffdbaf2e69d43f70b

                            SHA256

                            8ea94cbdcaae22cb989015c6e7649779136909c2050631cb4141971e46ea97de

                            SHA512

                            3b90f68456082b7d66f2cb6dd94e05070e86da32f08ee7bcb3a149b0eaf5bb54a197e8c51b4061fc4e9b19cf20d8a82ed58f0632d11ee7535fb46c508e3d0277