Analysis

  • max time kernel
    299s
  • max time network
    278s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-10-2024 13:43

General

  • Target

    https://disputedcontentillegalcontent.vercel.app/page/

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://disputedcontentillegalcontent.vercel.app/page/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7cadcc40,0x7ffe7cadcc4c,0x7ffe7cadcc58
      2⤵
        PID:1476
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,4575675402263755521,2899382238019802672,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1976 /prefetch:2
        2⤵
          PID:3484
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1920,i,4575675402263755521,2899382238019802672,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2128 /prefetch:3
          2⤵
            PID:3128
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,4575675402263755521,2899382238019802672,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2636 /prefetch:8
            2⤵
              PID:3460
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,4575675402263755521,2899382238019802672,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:1
              2⤵
                PID:4592
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,4575675402263755521,2899382238019802672,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3332 /prefetch:1
                2⤵
                  PID:2096
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4352,i,4575675402263755521,2899382238019802672,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4484 /prefetch:8
                  2⤵
                    PID:932
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=724,i,4575675402263755521,2899382238019802672,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3668 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1568
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:628
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:2932

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2cffe190-cde8-4f91-ba6c-188240d12ca6.tmp

                      Filesize

                      9KB

                      MD5

                      1cdf0cad88d122138f9f4cd344420926

                      SHA1

                      8c711283a2e46c781a51f36e56a6c32a28ae99a1

                      SHA256

                      9287ec7a2ebb79ada141a7265b2b9fd4c2fa1c0e72be5d9458cf037705a75085

                      SHA512

                      60ca752d68760330db4be73eed6af7bdd97be69361d006aa22e93589c68aa833d890f85d86d749e614304fd12c880dade359fc694ca867058a9cacbd034f1e6f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\79fecd28-51c4-40f7-8f60-b9719e595c1c.tmp

                      Filesize

                      9KB

                      MD5

                      c136af32b1f6cf6fd68d62db5602ea37

                      SHA1

                      8710707ef542e9684ecd91f3f3f30f1c08723bc3

                      SHA256

                      e9069aa24c5832ddad1f9a517769e03c83e433c9414008bc55908c8a937d4492

                      SHA512

                      91bb0a8fc9d3ab8f8511570d9e358824b37bfe82907fde83427ba4d705ba841c3a9d282f0ac11ba1fa59da175531a7d4aa55966a611a822a7f0b4da6f28dcb5f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      2aca211490554842bcf72f868ce802fe

                      SHA1

                      99b9fb70700e79bd8d0a2f01a5d7ae38acc60cb5

                      SHA256

                      64a44e24ef37bfa526cc941482f1860145909490f364b46a25d0195adf744264

                      SHA512

                      23efb89d07c65607c03a99e5ba59dae98caa1c5d0f03b64844003ac952fab66a26606ef54127f3baff32c8f649a96016cf7e881a3ec2802dc793b20fd53719a8

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

                      Filesize

                      120B

                      MD5

                      da2e4fecfa011da84f171879a7ad0d7e

                      SHA1

                      bbeace5ea4a4ab9515b3fe1501b5b4a7f48f7f6e

                      SHA256

                      fba6d9d37e6cf7fd5d4406443d01b8a47096e68562f4fcfd18bf65ffcb501ac2

                      SHA512

                      62dde308c5d96ed1a1201616ae582ed5b2fe974d6df381347bab33558c80060b9a31a5a0d27970888a1af46c81743999974be88986469df42ab1c15773a63486

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      3KB

                      MD5

                      6201345d7c5cf9262d101ee34a8d3a53

                      SHA1

                      03e1855cebda901cd10e1feb66f4fc29f409c1fc

                      SHA256

                      6ab2919bec8ec47ca0412f3e3d3ea4f8c8a669f9156880486237daa56b23061e

                      SHA512

                      c09ab1b2d0b3e2cc75c2f25bd2697403e172e2970e7114b4968130ebe13596a0732316bf15198ec1b37a4538c072a71d51bf0f289dac4fde5946e74f1f68f9a3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      523B

                      MD5

                      56aa6cf993802281edae5f0bf18c92a9

                      SHA1

                      2e7db1f0d36b38d9f21f3630c8fb3f53ee355383

                      SHA256

                      be986f8e4714fca540bfc6e4a902c8bcf069feecf1275589831f65efc4974d41

                      SHA512

                      f7e59a0f0d7b8281e3ca176bb10f9e1e633f0eee788eba249745afb226eae54c527c69bf6df4d9023a3861d93235c9e9a5fb9123d8b09d7f68b5e5de5f7fa106

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      5650cde31fd1d9bb1500555d9e745b89

                      SHA1

                      63348df0ac6fb84862c483082bffdd60a57d249a

                      SHA256

                      5d95827a6b4dbb5e673202207b7b36e9a57f3a72b30e7cdf956e98f7b44b6f3d

                      SHA512

                      58604de851c31586a373b94b636d2d9689aef6319eba64d476c7f3189c57afccd1135b1591558de8a62e95ca981911872ca1d336cdc007054182d02da32e5330

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      2d95920c9ccad133ba539dc7c3a3e1dd

                      SHA1

                      e672ea2643e3329c6236231e9dd4b3181628e60c

                      SHA256

                      4d6a97e5ad218a1ecee49f45b6dc5efd71cac696090a0aefe4756b7187962271

                      SHA512

                      b42ca36da1df7fa709e32c66205c69a3e0b231f14b8edcab1412e08daf52d63047828d3ec01eee6dd550694b968dbdc95fcabec7b2c9236bfb3fd130dad4a4af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      807d754f15cad39e6deb982ec676e74f

                      SHA1

                      1e949d94f240b9d7876b79f4c7a2201b5fbdb867

                      SHA256

                      ed78bfe6bc41e9b27450f821ef94a09ed0c8bf11b6aa9112c1900ca838b6aa3c

                      SHA512

                      1781ef9a41018842ba80b84a2c0394f7ba3e6e84d8598d59fc2dbd709d63ed540ad11cc5e06bc7376995273b3aca817f0de8a3a2852f0ca46225976e3ca55ff7

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      c0b23db097fd5c3a84ac6ce8c2024b29

                      SHA1

                      4c988f728e52e757b38cd96963f273fb3c369dc2

                      SHA256

                      a5c8d1c228d9661ebd1d22ac37e11f7df3ec075e203e28526fba4807b69e7b28

                      SHA512

                      55fd29f48b748c8e6fdfa7fbe92fcef8943b8792356a241c8f4bbb5fc1a648b9bf1d04afa4bd92df53ef674aa3c198c669c2b4e99809d6777e8f831e02351073

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      7e18f71695edef71686065ea16b17dc5

                      SHA1

                      eba02580346049776389cf644361b19152ea17a2

                      SHA256

                      8fe870323aa8ca232fcabdf3784114ccd91ad85b2cdb79398bc5ca6f933b86f7

                      SHA512

                      9d0c0c9c5c50b0d0aed673a96681e19f0b956292188a5dd18050ca09d8702950df3cfbc57515616f7b4e663db87c2719178a15db7b027479ce49647ef3c23ae3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      bed879b20cabb1253842b5b6214e0a1a

                      SHA1

                      e039eb5aff2d0634c3b13837e800e62af913215a

                      SHA256

                      208d46e0d246231e96093f243f9792abc15a5540ad8cb6adf2046658837bca72

                      SHA512

                      3d2d0b188e1f058b753fbd9ea56a56acc600468aa7b260e6182e282913d7c7af36527570733ff557abfdbf7a5b4bfec1fc5778fe16f3c52175f4effb38b12dc4

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      679775f2d4ddcd737c495c296c30bc53

                      SHA1

                      f7aed144cd0bce9028dd2568d90daac13552fe81

                      SHA256

                      d902b3ac5105a70e31bf31b6cbba2496b63df647ccfda9843b47d053390cd6df

                      SHA512

                      94417d1f0b37184acd99ae8551be3504e4f82ab399208fe8f3b41178ea99e2a51a2a8f6990a1df6c926b8d60813ab8ef461410ddb5b6333d7126e58bb6584cd6

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      7f705cdb25712b4d1bc2098912f599c4

                      SHA1

                      b4b8b03340823d99a00b87834db84bb86bf5b5d0

                      SHA256

                      92baf8c67cd56238a9cfc06d0aa178b1a639a389ca4f78c27aac0f17c01f82d8

                      SHA512

                      e1b19fb1e813ed72d49771f1da16b2c7cbfae460f6391872e344a8f38f49d4a26688e7fdc874027df49bd1eab37dac6cb5ebff638d733b6b436a71dcf0caf709

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      965e36afbc8c640317f01c604ac8d01d

                      SHA1

                      fa62fd4a2f5e4c23a1d67ffdde23a08033fe984a

                      SHA256

                      9e620561e4248c8d7ef99df35e824e59a1b9db26cec4f9801d626702bc74bdd1

                      SHA512

                      710aa265b053842c013c928d06507de0487af930f9bce76c6febec6bb95d6d2b00d8d5ee50782ea41c007f41217a017d5240bf8328e2240901115e114e222ec2

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      7000152aff7dedab53e5a1939b93ee29

                      SHA1

                      4a0f7e3068cdf25cdb17d11e60be7e2bf88fded9

                      SHA256

                      23dcc80f2cf07bc404433c24118fdcc279955078695a2d24764bff528e6182ce

                      SHA512

                      c8e43625d13e2fd94ddfb15353a5e5728d6968931eee383a253caa8a8da7d4e47e3980d3392c14c64118011ddeb1e1f3016c6629c89a578977f7da554007e786

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      a2a30961b0a835ceaac063701af668e8

                      SHA1

                      6ebb2898738b776b28a15c5f831611e4ef8c97de

                      SHA256

                      e6da590af60afc2d092742e7dd689c14d80185ca4e6f064bb90c1986c1a543f3

                      SHA512

                      cdffa14904d26813fcf81ab270bad118883779106103c9b7351b94921bf58503d4299761fc1de8207ffe2999325827cc66cb6c46f657d25ad715eb37e83d0ab7

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      a2b4a9cff0b4fe60f9f497c9afda0ec2

                      SHA1

                      0c6f4fe325172ecd4786f81a907fda2316ee4901

                      SHA256

                      49483efecc0a24e9a88620c4f1a14e74c87277ed4866f812936a551c8f59c3c4

                      SHA512

                      a86a3bb34e5515256ef9111f8ade62eb63eb4af3224a0d76b20d785ee4750dc2e1b60d0e098d2d19ee9d1d420011a5e14177965ce047a89b8ab560cccbf421f4

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      cb50172f027cf48a347d47ffe7015a44

                      SHA1

                      24ef26a13490b598c57c57fdcc0a577c730caa08

                      SHA256

                      88e2b8e1ef3bb839973edbdb79cde085b905737b460bb75f16b3b2f47ab2f7a5

                      SHA512

                      ff578c2cc21edf254c1b7271ac39d923cb0fbd49840a6cd6c4ca9a66aa30bf9d947d8ef06d1af5b8b3d3fa27aa59caa3486157e58071c1fb0e9628f10cf205a3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      084a358321fd65bb82787383aa240d4d

                      SHA1

                      5a8911190b196ef78b4b5236087c3fb4568791b4

                      SHA256

                      44427999e61a7c7ba80ed832ad97f6761ac88369a677ccd0697b99832c4f5e19

                      SHA512

                      3e09405ae00d529cbd0fa91ee1987d0b524b371d11579b68b423dc1ae1cffa8e646d1a0096e63ef7d58e1f549b3a68b3dd952b80b5dcb48e67f9556d14a3d8a1

                    • \??\pipe\crashpad_1880_AABZSWSWYZILXPQO

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e