Analysis

  • max time kernel
    50s
  • max time network
    54s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    09/11/2024, 21:39

General

  • Target

    https://172.21.124.113:80/

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://172.21.124.113:80/
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fffc58fcc40,0x7fffc58fcc4c,0x7fffc58fcc58
      2⤵
        PID:4424
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1912 /prefetch:2
        2⤵
          PID:4052
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2076,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2132 /prefetch:3
          2⤵
            PID:2288
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2296 /prefetch:8
            2⤵
              PID:1204
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3156 /prefetch:1
              2⤵
                PID:232
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3200 /prefetch:1
                2⤵
                  PID:396
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4616 /prefetch:8
                  2⤵
                    PID:5596
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4696,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5108 /prefetch:1
                    2⤵
                      PID:5392
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5096,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3420 /prefetch:1
                      2⤵
                        PID:5828
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4476,i,7765257517739413970,3408595408245323508,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4808 /prefetch:1
                        2⤵
                          PID:5500
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                        1⤵
                          PID:5148
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:2236

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0538a447-1e58-4cbe-965c-8f7a487dba68.tmp

                            Filesize

                            8KB

                            MD5

                            197b3956d39067e34052a263102bc840

                            SHA1

                            1b83b595ee34b999678c2b9a34ff2db19ca80d83

                            SHA256

                            ca4a1be79d786a01ab548f9189b0896cee743c290e0b73805fcf9636cba15b43

                            SHA512

                            0fc9fb4a98826be4da8c9135811b78f4bc61888a15733e0052bb05a09e9032da3047a474e5d38699ea7c04a7dab445159108fa3cf468c9ac644ec84ce83fd65a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                            Filesize

                            649B

                            MD5

                            e42cfb8645ccdcd22f0fc73fbff27075

                            SHA1

                            8d81eea92fbe436a28cf1998e4ca883690d7cd21

                            SHA256

                            957f9f9815b01cee1b37b6ea3628a7651a639d02e8f0f8eebbbbf1467e0d9a89

                            SHA512

                            79be02015eaadb90f4ebbacfe01bf7c762b85ffca1799cf850552aca7994f04f41cf474a9afdaf0e7ea3c2d042a288cc00359c8879ba5f0d50b39eb049341199

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            b0cca643501ce73a8f36d68a804487a9

                            SHA1

                            9beb382241c5dbeb7ab0605f829eec394ef88505

                            SHA256

                            14880f2ab9e59e8f0f4160bad8cd3fc461504e23ba2aac1e7ec6868c7a704da6

                            SHA512

                            78269f862a67b008844a48705edcebd08f509466af410bc47a7c3c18e87d0b42529229827ac2a152f36c38cc90f426ebe38ef97bb6de8126dd4b2fec72878969

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            8KB

                            MD5

                            370976724ee28c990873e31c329b7944

                            SHA1

                            d7e8f5779c79792eb7c6a6a8061c8acb81b4e884

                            SHA256

                            0e6c3d7d03afac447af538f08c595823cd14e83649893dfcc8d7a70c23e9fdf1

                            SHA512

                            0e658b3d9320b01afdf8f7f9d347ba927bf3522ed1fcb451022d7bd6d147a37f24d88898e6251c122fab4a8363508b3aadff08a532f94e270c73e3962a4bc094

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            118KB

                            MD5

                            740520429f2123a85ad20ce4af375799

                            SHA1

                            3f84bfbdffa760cec48efcb077cdece395a54dd4

                            SHA256

                            cd2fa14d3182a8fa288968401c58400af1208da33246a1124959feb38d16925b

                            SHA512

                            d1307aca80558701d847d27c9f5139ae0858d7ef6d8407e6fc2cb61aec0d60cb9b4acab465ae2317d354f287bd14bc3a25b83cfb9159f4d74e4e767fe35b1ef6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            118KB

                            MD5

                            9266d1885abf48b5dc689281c96ddd15

                            SHA1

                            968dabee02e27acdac99f873ea05281d9a50caf4

                            SHA256

                            e1654d2982480bb655f48321deb0f614d3e1aa04c654db3d10a298868a6598c1

                            SHA512

                            087edbc138de27eefe10c725ad779d9debcbe59d5ba55c9c22ced5573a7a9ec36be9fef01c1e9d2e9ac4c013f4ff4629d330565d1d768fac7425b7a719b8181e