Analysis

  • max time kernel
    41s
  • max time network
    39s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-01-2025 15:28

General

  • Target

    https://vqr.vc/mTUa6EndJ

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vqr.vc/mTUa6EndJ
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa5694cc40,0x7ffa5694cc4c,0x7ffa5694cc58
      2⤵
        PID:1864
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1988,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1984 /prefetch:2
        2⤵
          PID:3612
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1836,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2036 /prefetch:3
          2⤵
            PID:4348
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:8
            2⤵
              PID:5084
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
              2⤵
                PID:1336
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
                2⤵
                  PID:5048
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4588,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4392 /prefetch:8
                  2⤵
                    PID:4772
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4596,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4392 /prefetch:1
                    2⤵
                      PID:1992
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3140,i,17605833964318877044,16311501373179092845,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3396 /prefetch:1
                      2⤵
                        PID:4972
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                      1⤵
                        PID:2528
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:2788

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                          Filesize

                          649B

                          MD5

                          1b01ee9a7aa178580b920dacd1d2a29c

                          SHA1

                          0942b39b6adb091d5504c0a7dc838cd792cf2106

                          SHA256

                          7de381cdc65dfbdad63f3f9298dd7a874d8c2ef7ff6249e589270a71abf7f921

                          SHA512

                          a15a59b413bd9f2de05b0103e9cbfe6486e24d4913ccbfdff6845495e7d2691d6a16c324b8e84427f1451d2221b70df06f8488bfaaebfab487ef5eb5eafe7e75

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          240B

                          MD5

                          9b300bea5898ccf104bbd57485b5e677

                          SHA1

                          3a218167752f7457b774624c5f13dbf199a0498e

                          SHA256

                          edf0fa4830ee4d0381213bff719a010aa7de4929ab9f6cecaeaf9843f735b8ec

                          SHA512

                          bff8efd7aca2a87ee7f79d78425a49f0f1b74590e17fbc99824005e56be1888c427dce0c259f146c0a46736cd9ed2fcf6b550fa4e0134f75ce7b6e3856e0a7f9

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          f1c3fd24c79ffa46296ead5689452724

                          SHA1

                          7f9640d7001772bd0d068e0a35424ea4a3d8ca0c

                          SHA256

                          904d84dd2eb7c018b7e86206e934d014d6f5cd95e9f75eb790b8a43dfbda2c5b

                          SHA512

                          fdf7b3a3254e1e8b6fd57c522da3e948d0ac824cc81f7dd86d6e829ee7934872f20e1e11751761d0224263e0e7c0758a50e562e4f663ba5ead638925724f1f6e

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          523B

                          MD5

                          ceb0f0c99a5ececc3b5c427c58b18011

                          SHA1

                          fd4eb22b8989bec7b69d751fbddd3369dc5d05ba

                          SHA256

                          eda9b68a090b17d56dfe36bd60973f8c09de02d970f1d64573ceceef1f21985c

                          SHA512

                          f0cd6a4cdb594f78d7fe0d9a6725465297f92f5e4e128d388823c78cec7c9d637345cb83cca755757d1337da39880bb35e2ef9cd5e5876a7bfc922371882c982

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          691B

                          MD5

                          a41afe7e426fed0aded2416c1a29e2f2

                          SHA1

                          60b73f69bcaa308e91619e682be12de122f2cb57

                          SHA256

                          1fcd975e04a57087fe79ccf74ef7a58820ad2144964b3f9627fbdfe5f5a339c3

                          SHA512

                          0e991b6d5d47a911541498273892e45b0796297f4172d402565d334043cd29884c0742e3f589c26a42a48b65dffdd4034d512973442754b2a64bb58a03b9e5b9

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          811be7a36e9372d1fcbc128b78c0aa26

                          SHA1

                          94d3b1cac687b5f611fa706c56b3ba2ee6f27d92

                          SHA256

                          779e4dbe35d217987c341c7d3d5cef6faa779dc2d44d20c5af89e9fdcf3bc888

                          SHA512

                          bc362886357a5fcc488a95063744779bd20201c15e9bdea50f2d445e78e17de7d1a30029a8e6cbb486680a309677b884366f40a892bf32777ea6c111520f3b46

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          9a6f99c7603077548f2efe8472d18357

                          SHA1

                          3144afbc3292592eeb44d39b7a03cab4b4e3d967

                          SHA256

                          957841a617850d1664b5717fb6c9cbe6c38c29425661cf6069eace264a9545ca

                          SHA512

                          6916ac00a4703233fc02e03d1b41bd6386b62dc18a5da6362da17809f5e1d5179bc3e49ec127e3b294a675fdc2a2c4030e080a525b0688b4a362b643db2889d2

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          e68d935d43e97543c96bedd8d49290a6

                          SHA1

                          9c0880ed1c0a10f2cc48eee1594ed76f48f771e3

                          SHA256

                          412729075403bdd0561aaa5fb8a9c8a98840283da598362b2b36a2af82b67eeb

                          SHA512

                          ce741242ad5dd5d29639d8115018b3c70bf10e178c7c74579b21bd3c540f97ec2e726a53f98a69b04664e36ba18c112e9ce42f0511e315ca8cf3758a86b46cf7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          116KB

                          MD5

                          e7da9b65d09c507a26b38de63bd3e12b

                          SHA1

                          3c707ac8709b9396eae823885642c312688df677

                          SHA256

                          d427339285ede549234ea26f8e6b270f510cbfef7a515dbffe132de06e85ede1

                          SHA512

                          2fbc4e8469137fbfc0ca04595ac847966221a11dd498aa95ff5a93b46d7b3535b839719bc2b2863d27f00b6b83b08430a3947c4709fd695a41ae202014d6379c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          116KB

                          MD5

                          05f0eeadf5b00e9e3a433d2409665ee3

                          SHA1

                          a210dc6260e76f333e5240a4fe89e14437912860

                          SHA256

                          7606863ac3487d53c76f157e18bed11bf7769ce7ab7f8c35a4afe874220f29c9

                          SHA512

                          a7f1581b4efc00ecb3d7896d21f9c89e5262a9ae2dc92a312f01b2d0fca7f8465d1f7f67aa979958806e44f1dc7341888af07c5baf550c494dc6bb0bb3966055