Analysis

  • max time kernel
    26s
  • max time network
    21s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 10:21

General

  • Target

    https://comvehiclecar.com/iem/link.php?M=468851&N=16&L=6&F=H

Score
7/10

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: Oxygenwght@400
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://comvehiclecar.com/iem/link.php?M=468851&N=16&L=6&F=H
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:872
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8cde2cc40,0x7ff8cde2cc4c,0x7ff8cde2cc58
      2⤵
        PID:3760
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1928 /prefetch:2
        2⤵
          PID:2184
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1956,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2060 /prefetch:3
          2⤵
            PID:2764
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2432 /prefetch:8
            2⤵
              PID:4420
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
              2⤵
                PID:2252
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
                2⤵
                  PID:4876
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4448,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3684 /prefetch:1
                  2⤵
                    PID:3908
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4008,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3688 /prefetch:1
                    2⤵
                      PID:1316
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3140,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3788 /prefetch:1
                      2⤵
                        PID:4980
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4624,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3404 /prefetch:1
                        2⤵
                          PID:4728
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5052,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4912 /prefetch:8
                          2⤵
                            PID:2776
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3860,i,7978794337228098518,5703591415513144506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4924 /prefetch:1
                            2⤵
                              PID:3340
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                            1⤵
                              PID:2092
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                              1⤵
                                PID:4188

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                Filesize

                                649B

                                MD5

                                3e5e3c96a7c03aba5ee63243997a2a33

                                SHA1

                                6c4511fafda11470167b1a6d6ad4f4b7ecc0d72d

                                SHA256

                                9792bcab47748ca0b6305583e9e3b0267c88db86c2d486fc0a4a6f72e3967b5b

                                SHA512

                                d105ccaba5cd3fb1a329b527386c7fafed3955a09abdc16bebf619c57f50b4359e9b563b192c1880e82df80f04986156659796a32caa0ef44d3edfdb239d9f72

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                1KB

                                MD5

                                3a5323930f9b93d1986791a8f400b842

                                SHA1

                                642da37416542b895b4c5af1a0ec9aab1e7ed8b2

                                SHA256

                                8b103dfbe3831c04c55125f9bf73458f1503ee925b4b865c48a23105a6fb8958

                                SHA512

                                13db6d16dc930e4f47159dcd9785f67390d07895a554d2e1b16660ea6ab7a6c6dba0398ecbeaa2b514561c72f8bb696e456394537e4dd84217f1825b43abb400

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                0ca69040a59ae0fdda6352baf8124a20

                                SHA1

                                96c2119ce21360aacddd82685006afc2f7273aed

                                SHA256

                                0c8e79f2e6e3ecf60cd2b39144c15eaf2bed6d4946f26e924b80feceae909f7a

                                SHA512

                                236faf7803d0b19bb396bee9013c1f891cff697eb226d0540315d994296c7fd6e6faa66b145d5ec00339a64a08f594264944338b6013b1f2ee3e7746bf5dcc62

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                6f50b82fbe7920d26614f7ce4076cf8c

                                SHA1

                                945f359bd25b0c68349c3e3daf731c53abe95abd

                                SHA256

                                e7c27bf5e5116f83b3b795eb553a339881b2e1764679a522b253380dde324776

                                SHA512

                                8b954edcbd2ce7f69052b4d3774be829bcea9eaa08e8a69dfbc9536eed444ad357b0801ee06b6f8c5c79964624781265323b44f40b45e9c4cb0210b894b44634

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                Filesize

                                96B

                                MD5

                                aa235a56e509746062b651516f067396

                                SHA1

                                c69b0e20b1d81a285cbdc66c001d2bb3b78998fb

                                SHA256

                                235bc0221c032b1368dfb93ae74570025890a924e34741d2e2a4ae86b0a63ddd

                                SHA512

                                67895b101e70d22d514d90945e95d3291f56ada93318932f1fe1af51475adb7eb3bbc304619ad43b51eecb5a70753bcc18d4b24efc0a4fad10fa7b938ca72035

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                116KB

                                MD5

                                00ac14afb3437797c2af563c2c44e347

                                SHA1

                                b3737b994ea803bc40df2e98073e11838e2ffd5b

                                SHA256

                                53751fc5c4bf42d5c3040b8c32e9cc5b39e52d1aab0132d65467b9574a92b8a7

                                SHA512

                                022f007f59e8496e74b57224fd4df8e441fe9304542585db38e49e7e94df8c82dadcfd5148625a3566d2cb6af41bca53d4eec94aa286473c0bc28a6975689e41