Resubmissions

22-11-2024 20:22

241122-y5y4wsyjcz 10

22-11-2024 20:19

241122-y4a1nstqem 10

22-11-2024 20:12

241122-yytktsxras 10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-11-2024 20:19

General

  • Target

    https://avidgroup.famislnc.com/fvcvfxfec/cc6d843dfd/?1f9da=bWlmb3N0ZXJAYmNoLm9yZw==

Score
7/10

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: [email protected]
  • A potential corporate email address has been identified in the URL: [email protected]
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://avidgroup.famislnc.com/fvcvfxfec/cc6d843dfd/?1f9da=bWlmb3N0ZXJAYmNoLm9yZw==
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffdc20acc40,0x7ffdc20acc4c,0x7ffdc20acc58
      2⤵
        PID:5084
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,4777105307965636959,16029279644618756988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1900 /prefetch:2
        2⤵
          PID:2320
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1776,i,4777105307965636959,16029279644618756988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2016 /prefetch:3
          2⤵
            PID:4256
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,4777105307965636959,16029279644618756988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2184 /prefetch:8
            2⤵
              PID:832
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,4777105307965636959,16029279644618756988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3104 /prefetch:1
              2⤵
                PID:3168
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,4777105307965636959,16029279644618756988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3252 /prefetch:1
                2⤵
                  PID:2896
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4356,i,4777105307965636959,16029279644618756988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4608 /prefetch:8
                  2⤵
                    PID:220
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4284,i,4777105307965636959,16029279644618756988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4348 /prefetch:1
                    2⤵
                      PID:72
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3716,i,4777105307965636959,16029279644618756988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4300 /prefetch:1
                      2⤵
                        PID:2552
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3100,i,4777105307965636959,16029279644618756988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4928 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4004
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                      1⤵
                        PID:2520
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:1380

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                          Filesize

                          64KB

                          MD5

                          b5ad5caaaee00cb8cf445427975ae66c

                          SHA1

                          dcde6527290a326e048f9c3a85280d3fa71e1e22

                          SHA256

                          b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                          SHA512

                          92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                          Filesize

                          4B

                          MD5

                          f49655f856acb8884cc0ace29216f511

                          SHA1

                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                          SHA256

                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                          SHA512

                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                          Filesize

                          1008B

                          MD5

                          d222b77a61527f2c177b0869e7babc24

                          SHA1

                          3f23acb984307a4aeba41ebbb70439c97ad1f268

                          SHA256

                          80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                          SHA512

                          d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                          Filesize

                          649B

                          MD5

                          4580a27c534c8b022e7332763c97ebd7

                          SHA1

                          04943bf13d5e2b90788dafbc343e76cb910b2444

                          SHA256

                          b2bea0ba620c2f92e22ec9cc0b74280d0f7f34e2168c1e3fb7cbd4206c80214b

                          SHA512

                          d91fed3b40ac5a387df69c59fc370e4732bc238a5db5267cf0e4c54d5df19c7afcc724d37e4319ddac24a2428390b7b39e3f62385d4b22e5c9ae29af5d88f605

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          264B

                          MD5

                          a87200ddab4f3d3b83b8dbbfa0753a80

                          SHA1

                          c61708844a4a3dcc7b8eb2a220f8a4a341cb4476

                          SHA256

                          baac64a6c2903a433ddc126f3a01653c7f92010f3005f734f0c88443a38414a7

                          SHA512

                          b37a52a0f954c3290ab21da3e7001f719f2c4d3e65349350318b72a89b4863776dd7f9a4f0cff8e395a5fd8cacca6e398edafc627b9f28ceb435d1b1d8e85983

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          3KB

                          MD5

                          773c0431d635ad7bdfd5aa6cb04b0a40

                          SHA1

                          5cf646f82653aadd32ebbdc15d1fccae896c6722

                          SHA256

                          c1b7921e66a0efe8afa6293459567fbe0d8ddd9003d4c931add6d5240f2a00e1

                          SHA512

                          c01b41b910e8afff05c01082ab7a4e47071e2d5977294b91d4e51826211457ff45483eac63e02da27cde17f3bc5a4c86941d73a68ee905ce752be543bb554e3a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          4KB

                          MD5

                          5048512802c7a11a4c6c18ae82259830

                          SHA1

                          3e75462f6862f7542961bfc075e986b0eb618aea

                          SHA256

                          f03638bae797e0c3e84463ed333786b5ac35f0522b5cb3559cf9766e6659d4ab

                          SHA512

                          2db50117aa1f0102fc8c1f16a55f33e67b64d93cafef920008a72bc00c33fbf0dddc6b05608d01dcb50d86785464076cb30f21106f21678e37054c88c60c9a81

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          858B

                          MD5

                          33bcf49f765e26c133175a8055a695e5

                          SHA1

                          95cc7f20f1e8f4c97f43e7d67162a02db2cba19e

                          SHA256

                          ab62890b9de7281df65c1e6bfd6b41599bbfd7187a68828affbe607ba177e2e6

                          SHA512

                          2c1302baae399c2f5f251beabd9946621966e9fff997cec496307233840d6f8fe2197c19096721bb8680cf6aa38d1adfe1b45d257a147e8b686bb03c87d13a11

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          07306afe219b4dab2f118df7e7ba77b3

                          SHA1

                          a734628d6e449ac9ce309803e385c238699427d3

                          SHA256

                          141af7013c7604c3d56d4fc523439685c1f6d7b4a63eee988763c3ddd553ed2b

                          SHA512

                          92ea56452596688d0a4993c0356025d3aab716e40b9b77764aead220dabae6bd994eeed333084c266d3f2f451e83bf8c38df7493530c72fda27cdbd4db9436cf

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          10KB

                          MD5

                          eb5ea4bfa45243ca36be5a1ca741e916

                          SHA1

                          cb6f9555f06181354dadc78b090494c19abbc860

                          SHA256

                          8d2e53aa48d53f7c9196d665c1e4a0c7e59a44de70bbad10f897509b7a2eee13

                          SHA512

                          0b285f95e4bee5bc8656747221898b1a21e088f8c0f79dadfa42eb00941615655adaba1587689de226c85068a935f7e1e06399638d8bbd7543ea855485619831

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          273659827ddf4533c344d52329caf12d

                          SHA1

                          bb821871c08dd8d2f7be8825bb474c3828c33f83

                          SHA256

                          d2225291fcec452f71ac5f5198d3f9cf7c0f1486070076151268c60862d74d71

                          SHA512

                          32a9c22e0c2e8dfb7fa25d4e60b21b156d1b5dc323b7c773b5705011bb2f2b070eea3cf9b54729f126e2c921ccb8a6b4128038cf5c540521afc5ee3520f1712f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          4ab109992dfe6d757ce24e601bd09dab

                          SHA1

                          b1ccb3ac1f19fdbf7986b30d3355c9d43d63421f

                          SHA256

                          d23393d452be6ad3e65f86b6a7753a2cedf82d263543d129c53bdf62b20796e4

                          SHA512

                          0368f87647b36401a9df99829760cbf7e216f1fdfa7d27cc7c7671e46d0859c605cb8cd4d7c652edc3230d6b80037b00b29f127e846db5171ead8afeccdc4789

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          54dab108d49f015ffaa034a1a688dd5c

                          SHA1

                          4723a8e45b45d1380009377f2ef0f8cc955b5c37

                          SHA256

                          14c9274f83778bdca2a3b2cfe8fdb864e4bd69cb7018c19dc962cdabc0652ec3

                          SHA512

                          36ad56affa1d55774b71be074ea28e7f732fc75dc450d5b338136acf153b98ed6018127bb3e9ba946b34ac110d45a4621f147cc71b9770050e8000f48f6ef133

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          10KB

                          MD5

                          2442cf155cd1fcb900cde988abb4340e

                          SHA1

                          e6967a484a10ddae377dc2034166a026a4adccb7

                          SHA256

                          ab3a5f16c60fd4ab0b22f7055e85117da7e26fbc68ff910f8561f25be86eb604

                          SHA512

                          7b32c7e815710446f7e6a0fe5829d49b07f2f938f4dc5ef200b674f0d63e8a9ada4d03c57eb59e577196690fb5264b5be95665cfa937464f9d8105087ff500e7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          ca91b3f5e5b82ec6f9bf8ce817725787

                          SHA1

                          44eac5bcfe0374b379f6e43b5a04dcb4bffd2fc2

                          SHA256

                          7e93a5b91b24a0c885c6b8e855576e02e2a59b362591ad35d50f1b0178cb074c

                          SHA512

                          7391c0da105d6f491e5d252efdab40e0169ebe3310e76e3126356902d55830923e4afdb25fd93c59a54a8985cc131e7c8c4f3b8ec46dbe69c173b087a441f6c6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          10KB

                          MD5

                          07cc5b78accf78ad215d9237169be6f9

                          SHA1

                          ea41074ecc3b8dc4e283e45cf807cc0c049b4716

                          SHA256

                          307ff64d039a7731ddfb3166f5016efba3a8a72f91c93b65cad273e27457b064

                          SHA512

                          433f24e932ed2c28c6810643770a901c2d34b369d4dd371125509a69253c36966009f973c6357da6dc0b83d16d3bf23000441ea2a9979e283ab0b9ccb99d2e33

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          10KB

                          MD5

                          6416ffe660208d2ceeecc146ee8189d8

                          SHA1

                          e3c02c6d2037d59a3b236bcbd3de97d69095a794

                          SHA256

                          96f952aafd68a597766f30eec2e521e0d0e66c4a9ced76b18a217fa25f382b4c

                          SHA512

                          b1eba45390e07c6401059c773f9f73e1dfa4959e8cf33099187f07c660fb0157640336506c13254f6b16aad7ddf8155d53767b6a23d4479b9e2c0be0e3e026c5

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          228KB

                          MD5

                          95e0888c71d7ff31e40b4b95e455fb48

                          SHA1

                          c97fda78422a2c9c49ec1b712bd3bf18f43ea1d4

                          SHA256

                          df1a1e4af85f244db144151caf013784591800c834dfbf8223f3f7a0f6d64ff5

                          SHA512

                          5cf8ed4517d8d705388ed1c48011be95a33e86df3bf11aed227fcc63385ad7dd019e3d88847c76cda7c36ec23360b9f944f37ba5b068de097544bb07002bb22e

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          228KB

                          MD5

                          b0c7358e9047d40d3d329ba0be1c2528

                          SHA1

                          c1014ec1768eed67a9077eb39fbec9c6e18c72a4

                          SHA256

                          f0f4fa299e11a7a8204f3836e82b0bf84b46387e9d0c78cc50fe2f4cf2fa0dde

                          SHA512

                          b93839ef559603604ccb8a4681eac7e1b19146c424b77d8c06f32362042e98f5505f076b76dc6c96447b21185b561215c6402538a7fc89609b81d198abf90179

                        • \??\pipe\crashpad_4236_YWAHVGHQKUYLRRIW

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e