Analysis

  • max time kernel
    84s
  • max time network
    82s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 19:50

General

  • Target

    https://messages.alllowers.click/communication.html?now=Ojg2KUg6NllBPUJZTTg2QUU8VkFXODcpSTAnKUk7IllDO1ZUIA==

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://messages.alllowers.click/communication.html?now=Ojg2KUg6NllBPUJZTTg2QUU8VkFXODcpSTAnKUk7IllDO1ZUIA==
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3832
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffef755cc40,0x7ffef755cc4c,0x7ffef755cc58
      2⤵
        PID:4164
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
        2⤵
          PID:4740
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2184 /prefetch:3
          2⤵
            PID:1384
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2256 /prefetch:8
            2⤵
              PID:3076
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
              2⤵
                PID:3996
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
                2⤵
                  PID:1072
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4356,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3784 /prefetch:1
                  2⤵
                    PID:1412
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4396,i,8149280788916621543,989376976813349797,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4656 /prefetch:8
                    2⤵
                      PID:4384
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:208
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:4992

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        57859ddc7a953d6cb80a1325ec63cf49

                        SHA1

                        412235f55c7572fc9f7c016e0cda74a1104841f6

                        SHA256

                        9307d37112f57e453ad9260d96e5b0a87f8ebed6de3975f1ca2e7eab78f7f06c

                        SHA512

                        a4c5312acf6079e3bb34d7006728ef646d32d28a340b6bcdd2f2e429420dba42d87395534d27dacf790913e1391197cea470fb673b064cdad647df2db0523d97

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        9433fc59bac1ee1d6c076f6c0d759bb2

                        SHA1

                        1837e33dff1737cbb835a3119190963391e0023b

                        SHA256

                        573edce4678c166ea44b2f1bfea8a73ca0577aaafc5f51f5e55a92c932916cd9

                        SHA512

                        1377aa692a518f0832f95535e5dbef08dddbdd18668d05235c1e1fa1c59b6d314d75f853b512ce817075850aa7b56550acc4f85b7b4ba61fce6798bb031d5b08

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        13a4a83549f366a144a033714770f6f7

                        SHA1

                        c697a073f04c6cdfb9e36a33eb8f5d9bdb827a45

                        SHA256

                        3e23a105eb5cc304a014353f38f072601178fad49a6511c68c105ee1710d35dc

                        SHA512

                        4aa7edd9f6686eb20a3ebb52e1d4b3023bab7b072b7295b1c6f1456a80312ee5c938e3fccad8edbb246c9ee94c7638efe118aece80026414d9179d719bcc1a2a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        499a1a7f17fd8e73d0866f5f1767d912

                        SHA1

                        1b094eed1e88df4fcef01196c8e0cbc7901309d6

                        SHA256

                        2121adac47a7e226f96a791d455f8fe4cf14e29f292e5bf336bacaf61e9589d5

                        SHA512

                        2fdddf8b1a3068fafa14c016023ab871dd9ec5356056d9576a715cd6024fc768577463d21df14eca9dfe164326e6f41918ff538b11d5f3024744ecb4c451eb06

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        3489ecbf6bd91337eae89482c6281b63

                        SHA1

                        b5a7e1b3f6210c51b07ff55b2806de79c266c538

                        SHA256

                        70fb8dfef83bef684d6da36182193d6beb721a7fd8c3d992bdfc901d8d213440

                        SHA512

                        13187d1106cfa86dcc726ed1f60022c1d2dcc17a0b9a99608b36709facbcab0edfadd468a78f3fd76287773a10e820ce49f3acc8d737842f6b55ab70fedbd3f3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        babfe075524d55e1c3729265ba4e4bed

                        SHA1

                        eef17933a92944660a93de5dfb6e7a59414d4dc6

                        SHA256

                        85c31e916e368aa532a71ada841ba7af412380e2b6d9d0c0c4b724d6de19e08c

                        SHA512

                        cfdb283255e5eee9c01f3a4fea67269524559c8ead4b448f3b3c410849ba8df8db1a4b17d43b113d759ebc72b65fe7f7481f5455e9f83fb4c44233d921ab08b2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        116KB

                        MD5

                        1c531b9389653655605834fb9cae0680

                        SHA1

                        0761c2a691fb1b1a2da6501b1c7741a1b9c257ba

                        SHA256

                        e6f820392ad2495c344f1d0ba51abfb8309785320198828310d2e0866d3ac78a

                        SHA512

                        329bdbff8b43ddefb378af17fe521c8edffe3c3e929287a4e46c8322038a787c501a2bd907395b2bb19445f89e7d6e28b207dd404e00b03538832ac45ee8676a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        116KB

                        MD5

                        669bdc4b060a593286ff6c32c006aafb

                        SHA1

                        f509808fc9cd9cf3aad7fbc1a9771701f3e06582

                        SHA256

                        af361f50c8555c1ea734c1ae8ccee05b015aef3f6e77aee0ab91101e2bc65a93

                        SHA512

                        bf04467e0ee22d82b216d208c2fa10d77cb78fa4f572027542734e045e75983082f7da8c969150f8e49240cf1777f17bde72132429e3ca83b78c832597a4c060

                      • \??\pipe\crashpad_3832_EACRPRCXGKCLQRNO

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e