69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf

Analysis

max time kernel
13s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
Size

2.3MB
MD5

25a57ca9705d6c152364fde824739bd9
SHA1

46c963dabee4764a53c4d08c91ee0db14c178aa7
SHA256

69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf
SHA512

ad352e1b4e803f124be454bf2eb1cc79d3d4f2d2e1937ef06bf564cad847c9259ed0ec02b710c7e3555e285c87ea9884fe04752bd8065681b757109462a916c2
SSDEEP

49152:clrmUVf8+40VYICXJ3QOWLfFBgPl5rnizvs7PWY:bUV0+4wGXFiPgP/ri6PW

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/3192-3-0x00000000008F0000-0x0000000000E40000-memory.dmp	autoit_exe
behavioral1/memory/3192-4-0x00000000008F0000-0x0000000000E40000-memory.dmp	autoit_exe
behavioral1/memory/3192-5-0x00000000008F0000-0x0000000000E40000-memory.dmp	autoit_exe
behavioral1/memory/3192-6-0x00000000008F0000-0x0000000000E40000-memory.dmp	autoit_exe
behavioral1/memory/3192-7-0x00000000008F0000-0x0000000000E40000-memory.dmp	autoit_exe
behavioral1/memory/3192-8-0x00000000008F0000-0x0000000000E40000-memory.dmp	autoit_exe
behavioral1/memory/3192-9-0x00000000008F0000-0x0000000000E40000-memory.dmp	autoit_exe
behavioral1/memory/3192-10-0x00000000008F0000-0x0000000000E40000-memory.dmp	autoit_exe
behavioral1/memory/3192-11-0x00000000008F0000-0x0000000000E40000-memory.dmp	autoit_exe
behavioral1/memory/3192-14-0x00000000008F0000-0x0000000000E40000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

pid process

3192 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

pid process

3192 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
3192 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

pid	process
3192	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
3192	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
3192	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
3192	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
3192	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

pid	process
3192	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
3192	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
3192	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
3192	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
3192	69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe

C:\Users\Admin\AppData\Local\Temp\69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
"C:\Users\Admin\AppData\Local\Temp\69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
2⤵
PID:4440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc4ec79758,0x7ffc4ec79768,0x7ffc4ec79778
3⤵
PID:432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1932,i,13157355267386910512,15192739497709221587,131072 /prefetch:2
3⤵
PID:1972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1932,i,13157355267386910512,15192739497709221587,131072 /prefetch:8
3⤵
PID:4756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1932,i,13157355267386910512,15192739497709221587,131072 /prefetch:8
3⤵
PID:3012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1932,i,13157355267386910512,15192739497709221587,131072 /prefetch:1
3⤵
PID:1908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1932,i,13157355267386910512,15192739497709221587,131072 /prefetch:1
3⤵
PID:3620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4664 --field-trial-handle=1932,i,13157355267386910512,15192739497709221587,131072 /prefetch:1
3⤵
PID:988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1932,i,13157355267386910512,15192739497709221587,131072 /prefetch:8
3⤵
PID:4576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1932,i,13157355267386910512,15192739497709221587,131072 /prefetch:8
3⤵
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1284 --field-trial-handle=1932,i,13157355267386910512,15192739497709221587,131072 /prefetch:2
3⤵
PID:3344

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4384

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
6f5694a74b3347f7c888d504a5c055ef

SHA1
766cc68798c21bfebb278d26ddde2817c6f1304e

SHA256
ef00a8cb0aa684e01881ea14410b8d33dce94b6632fada2481db6c92c40a04a8

SHA512
d6ae5d7171842d855df6e534d9fd4fd92a38bfbb9aa2ee53221a3d2e59cb74bcf468ab6536f2c14b715e1012c791a145850ecafe0ab0070aaf12983c7c153efb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
215b48476fd25a020d98f35668de822d

SHA1
74a47a8a792681d86addbb94e13fae6fc532d4e7

SHA256
8df857c70321b59bdfe01f3b8199207a01332634bb83c91b5649aa7f414fa642

SHA512
2a19424ca78b03fae37e9a163ab47188daa18815665174648baa26b0b75322ba75d69f22c2c7bf0c50b94a6d3d6c8672d103473f7145b67dde0b1164b5a07511

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
535B

MD5
1d27623235b488b5372e3209a856ecc9

SHA1
bde8d36dd24c96e3df3ae8c00680f882be3b5b84

SHA256
719780cad03fb83f19fad186f5c607d258bc7e6d823084ad6380208833ed00a1

SHA512
f25af6a2489a0336cb8fce46a6faa17585f5c2cc900d7f7e41d8fc663f2ba780970b850522f538221b0e265f972a9f9a28e2c946fc48da67efad47d2a812df91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
8768bda571ba35e5ca79345ce2c45ce0

SHA1
3c9e06b9d357284ba7bb0209d0aeb3d43f63181a

SHA256
0a162fea620d57623b4cbfa739a92ab6216934524a2e307c1f522b2549bb5a22

SHA512
de642c5c2052c22a847d8b6e6340dc836fd1b6ff1ecac317ab700794667fccbd439da102ba1a4b184d6e4f6412f5f861d4181ce439616b4db1452d174aa4c1c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c6d5354f90c9237dfdfd647a28e50165

SHA1
a235a51e2d6b70e315d18664089a3f5099fe2300

SHA256
2efcd593f52a958e32ab4403dc4f1f202687f86fe815a0a4440da50051d9178d

SHA512
ccc6dff3ea8b83d05977d45f013ab2fb6207a3811bbbd8aaabfada3041d227eeb38cc7bc45d925118d158407f1ee2276439ae63329854d69548e6fef817b6cf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
30bbf801d1dfef13dc615b6a2f717048

SHA1
7166d0cec24fda8414c2b8aff773e23e926979e4

SHA256
c450fdd5bf5378a0ebef859c10e051f1f0853a2a38fa7c315bdc511db11863cb

SHA512
70eb517fbcb2893f93f830975a681b18a90a3339a530e2405324f0ff1e12c90f2bf7223959f59b34bd2ca47ee19242303839bbb1bccde41827e7bfe1836ddbbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
281KB

MD5
94fbbcc3ff1d333e76a49dc91f790308

SHA1
07492fd7566ae53a318f960a8937897fecfce705

SHA256
fe68d9b09e72c507997bb62b27ca5ed5b2e59302705cd90432c09fc4b32506e3

SHA512
30e3b717b759dca3b3c48bd66e6691043aa1b8a0d781f6253bef0c3e395be303d98f55909b1ea196c365af845c02cb953aae8cd842257eb8772cd40066818118

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4440_AETVMPLYXIIGPRXM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3192-5-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-10-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-11-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-14-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-9-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-8-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-7-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-6-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-0-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-4-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-3-0x00000000008F0000-0x0000000000E40000-memory.dmp

Filesize
5.3MB

Download
memory/3192-2-0x00000000008F1000-0x0000000000955000-memory.dmp

Filesize
400KB

Download
memory/3192-1-0x0000000077694000-0x0000000077696000-memory.dmp

Filesize
8KB

Download