Analysis

  • max time kernel
    299s
  • max time network
    290s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2024, 15:41

General

  • Target

    $PLUGINSDIR/app/index.html

  • Size

    20KB

  • MD5

    c7b752acf6d1e10f3aca2c67b1ccf4d3

  • SHA1

    ab793cb43e0c2b5af0fdcbf90d0d29d5d3e164f7

  • SHA256

    69b9f99f6611f953d94984ac35bdaf9e9817f689e1e3614976bebe3465c613fc

  • SHA512

    120addd79b7ade4f35b426c02631c8167d81080fde30a01b989453113f7547784e525d53bede41ede0c9b3caca8513060753ba51f75bf6936d32ee597d642576

  • SSDEEP

    192:8sdqpDNDPkFHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ/Hab48JgJnc5w/93mJ8D:+WNaM8UnbjPk89+mppHL

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb07facc40,0x7ffb07facc4c,0x7ffb07facc58
      2⤵
        PID:5016
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2000,i,7955594978613844114,10155466493416226112,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1992 /prefetch:2
        2⤵
          PID:808
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1904,i,7955594978613844114,10155466493416226112,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2088 /prefetch:3
          2⤵
            PID:3700
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,7955594978613844114,10155466493416226112,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2256 /prefetch:8
            2⤵
              PID:440
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,7955594978613844114,10155466493416226112,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3128 /prefetch:1
              2⤵
                PID:532
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,7955594978613844114,10155466493416226112,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
                2⤵
                  PID:2428
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4592,i,7955594978613844114,10155466493416226112,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4600 /prefetch:8
                  2⤵
                    PID:4948
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=724,i,7955594978613844114,10155466493416226112,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4736 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2368
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:988
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:3520

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      a950a153a4930d1daa2da9bad856ddfd

                      SHA1

                      80b6c565393cdc5e6c217c461b28efc79615b9d6

                      SHA256

                      7e17018946adbf20495e63ece2800363ed6520bbecd9fbbe80563852db8cd33a

                      SHA512

                      4cb848b2a3cd4ce4c805b25e1a88e3c82211de1ffbd3f4e32e1cf6f74e500b0b2568b9d3600371edf1cedf69f750c55fe85184959241c49262daf94d026978e9

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      53e74c6b5313a1b5e22334570648a6a9

                      SHA1

                      004bf0d7637cd32cad5a45be53137b24e1c2e0b1

                      SHA256

                      546d046db5ea4382ba186bff43352a8a349c30aa7a89fdc432bf13dbd682b563

                      SHA512

                      e6eec6c601a854efa8273e39f919da8302f855b3bc80dc6e2ee607f1f84fada27d4ac041c103d5d90ff04785b79bf36f63a169670046ef9c191a46bdff452982

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      522B

                      MD5

                      28610552d473c07d2e25e65f7eb8b425

                      SHA1

                      64721aa4da33ad24bd9011dbd31a528086d2a42d

                      SHA256

                      b016683ddaf78c2919a589f6897d0352ea1ee78f2f9bada1194a86ce3758ec26

                      SHA512

                      ce0edcfce4b673def4d5f6836b93cdc77eaa9862d24bec0d18ce656097610ab7d56b318b5c1db163494ba963ec224651497c763261dc3cf28f1dee41d35b3b6a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      01ed1ac24746d6511f635d85b796e06d

                      SHA1

                      0a1d3664e9eb42252154607f27dddc29bd57a280

                      SHA256

                      d2f406a40e05451c2ffcfd9441fda4b4b1584fed5a74e7bae9694895be6ff860

                      SHA512

                      3c75383a1b1449fafa7eae09f740d48579be816216f9ca7d12cc41244a42d2ec934e232487d3d8df6d71d7ce87c7006e4cd520840a2ac1d6e4f2c632eb49ebef

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      efedc8914fe5f8728734a93487d5c2a1

                      SHA1

                      a2b45e431cf1872a87ee7399d66767a0d35c7a9d

                      SHA256

                      8b4f76905e7e03c3731b9f9ef1973179a608617aaaa03b665270f4183cb13a6e

                      SHA512

                      f016c818573ed19f3386c4567dded0908e4286dbf0302bccd68de6b20f054aff3ce158a4959d0102cea6214ace7ebfba38686d752c88bada7467d638d22d2482

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      ac3007fa3be24c8613f8b676260aa856

                      SHA1

                      31dd524591287652bf257bf39cda03b249493350

                      SHA256

                      98096d85127f553f84aafdf6b739a6bdd658ec8b5508c90daa4ca44967c5040b

                      SHA512

                      7d8fb768470d0cd6a4c729a103aa4a08a17f040f9fb9effbac7030802fa49c27f4ab6e5c30ee4606320b2caabedc70ef89336a138ef07964458e55529134b214

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      84a63da779412a3ec1fc962aa38a5acc

                      SHA1

                      3790ade469c6e2371607aa80d7ce9ba92717a9f9

                      SHA256

                      482c96c5cc7d9710762bcf6bbbc4d1c4842c5177ff0bf0add0905db8581bc4c3

                      SHA512

                      cd9fe8b117df79c4a41f1e1d7be92e297d40332acdac140b7006f2d805fcd5ceb0c083c57b4403fcb59123d779341f2e98fff5d65811b821e7f926f77487008d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      3c9e7f62140a2da2839747590a862840

                      SHA1

                      17961ffdab59d5923acfb9e0a274a7d01d5e8c98

                      SHA256

                      d4eb8182ec2dd2650a6cf4e00430fc011d619ae32e37200a58b3fbeeb202edc7

                      SHA512

                      af09b31e84e800f8abe74df94c3f322fbe22d18eb43de4d6231bb43e648104397be07d1220a8479234f1787e4fd1f2d139eb7c6a505e44945943f686d4bcb378

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      ed0312ffaec0a987bde9705773be73b7

                      SHA1

                      eac4fb658b3ee16f114ed49a201dfdce5d15a7dc

                      SHA256

                      bb8d7db6852cd7a209193b3f1af20d8e74ebb81a77b6170dd71d424c1a2496dc

                      SHA512

                      5d01d09b7d0ceca3cd5257678316eebb1d20f24e38384c29e649114d8ce56473f147cd047f559b659f21366ae8c73ce5aa6b2955b61abba9c8a7834a3b1707e9

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      d4d376cee40e25a927b90eca45d186b5

                      SHA1

                      2cef49973f237a9b0f75509b6f1dbc8af41c85f2

                      SHA256

                      51cf98cac6e70919fae6011a1311a1e83862abc0dbb3551683436bf622f77e17

                      SHA512

                      2ac29fc91e3276a289f26ad7ccfe1983435d2965e21f3daae26d259fba26d6e1084177241eb4a6f3aabdb32985608f835e6fa4e04cfd918d738d7628ac3a01b5

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      a00d498bb83647079ef5ea8fdcacc4ce

                      SHA1

                      967dd8ea3e075434acf7617e0f469e372095db7c

                      SHA256

                      1d057034406c58ecb3cb7cbaa19563bd3d0a59b74d7a9452810e872b1c35ab28

                      SHA512

                      cbf248e4fa2031450c81229cee9956685fb8ef2343b63a7a83eb9977700a19b191d35de9ce9a6760db14f162111221cc4696deed3574cf46be4fa3eb9e0a0ee9

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      144fd5b2ed8b8411be8144dcc0c372be

                      SHA1

                      574fdd2ad58611ecda1972297c4d5b81ebee0ea8

                      SHA256

                      d06c95722045a85ab253e3e975e1b99f51a8d1a8ed089cbc3ec521e737b22b0b

                      SHA512

                      7169366af816b7f875844c718773bc6aebe1b3348993531f7691f533fb580a8090179608b69246b7f377e659a76a2fa941f0cc588858455ca50dcf63b5ceaad5

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      344e2750c635d9ffbb828ce198be824e

                      SHA1

                      8ca3feb52fdf983f242a78e3a43f68f99b050587

                      SHA256

                      8cf74bbb53c274db352f78a5055fd07872652baa0d0bdf4c1ce6bed62d4ef17f

                      SHA512

                      c87bb24a01df214d2ea37a17c933a0101ead676ca734b64b4821d0d079d2e217700f06ea22fce1c2a32a27df5965dd4f1c7cb706c5487ff12045fcf574bda169

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      45b73c80a06fa8f78ccde0b533308dfa

                      SHA1

                      7a275869ff44a18487e8379a0a973e08633b0322

                      SHA256

                      65ced5773d0790d13df108790ad0a9a4c218376d278c7bfd9945354e3cff29ef

                      SHA512

                      06e479689970b6c63bb55776f9c8bd63c8a87dc6c3f84e7e09756e510737d9503a0dec77959e698921c7f92cda53079f10e3badffcc7f835255294e7d824be21

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      f02139c49c3c94146dc616177fa747b5

                      SHA1

                      585ba2df753afbee0e4d9740ad17539005161022

                      SHA256

                      4de92fe2ef013623c5f75e0d5208a58d9b6e27f3595765f6e4de0a11292ffa1b

                      SHA512

                      ffde7b211100b043e3eb825b331f6877b677a18cb4e34beeba2b88c803df2f404266d35d6d990f60b310b3060372f0bbc7209979f0801bb3f221bb673ac41bc5

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c06c3711-2402-4a9f-b7d3-5579e4af96d8.tmp

                      Filesize

                      9KB

                      MD5

                      2404732d0b92dca6ae62349b7a3d8f38

                      SHA1

                      950a233589ec6410785c2145585fc1b4caa3e8a9

                      SHA256

                      ede1091d2873d592484e0348b586a8df05d7ffc6bba8d639ec5071f5e0bcd32a

                      SHA512

                      1fd9b7d53c2348ba63c344a2cfe0f18226bd9abd1c6b3c973910bc5c73aea4deabd8ba19d851a928e2549a28e015b11976383e12e6ff3ca2b0827fae22f56ba8

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      92459063efb3dd597dca7d43c9916bfe

                      SHA1

                      c0ed29805ade63d7cf42467925083a2e7afd6820

                      SHA256

                      1f05ae3de1db91fe53684cc82b9079e9b3c4bf869f3bbd6c3d2e0fe72474abfd

                      SHA512

                      83380fba8fcc05cc0462628fb3b8dcecb72c29390ad502dc6042d4336268ea0269ba0bc4dfc61cb64cd1dc91d57516d3046ce043b084406836e5ed48899f661c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      072abea00a275860834c85a7d48768d9

                      SHA1

                      518835f077b7c44fc3aff9d5cc1b2380f8c8a239

                      SHA256

                      48555642ef0cc8cd9497627c6891bcdefe655c09b0672669bd4e01bc96334e8a

                      SHA512

                      5a6702c3b0da7e94327f96637d1fde47922929f254a5e18c8969cbd55884589e1585ee761f691472e9883906026460af67edaf1c741e864286f467c1bff43add