Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
01-07-2024 03:51
Static task
static1
Behavioral task
behavioral1
Sample
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
Resource
win11-20240508-en
General
-
Target
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe
-
Size
2.3MB
-
MD5
25a57ca9705d6c152364fde824739bd9
-
SHA1
46c963dabee4764a53c4d08c91ee0db14c178aa7
-
SHA256
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf
-
SHA512
ad352e1b4e803f124be454bf2eb1cc79d3d4f2d2e1937ef06bf564cad847c9259ed0ec02b710c7e3555e285c87ea9884fe04752bd8065681b757109462a916c2
-
SSDEEP
49152:clrmUVf8+40VYICXJ3QOWLfFBgPl5rnizvs7PWY:bUV0+4wGXFiPgP/ri6PW
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe -
AutoIT Executable 19 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1216-3-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-4-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-5-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-6-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-7-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-9-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-10-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-11-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-12-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-36-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-37-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-41-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-58-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-59-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-60-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-61-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-62-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-65-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe behavioral2/memory/1216-64-0x0000000000D10000-0x0000000001260000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exepid process 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642795742317893" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exechrome.exechrome.exepid process 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 4464 chrome.exe 4464 chrome.exe 2408 chrome.exe 2408 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
chrome.exepid process 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe -
Suspicious use of FindShellTrayWindow 63 IoCs
Processes:
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exechrome.exepid process 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 4464 chrome.exe 4464 chrome.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exechrome.exepid process 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exechrome.exedescription pid process target process PID 1216 wrote to memory of 4464 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe chrome.exe PID 1216 wrote to memory of 4464 1216 69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe chrome.exe PID 4464 wrote to memory of 5008 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 5008 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2316 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2732 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2732 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe PID 4464 wrote to memory of 2848 4464 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe"C:\Users\Admin\AppData\Local\Temp\69c65e344e4abf7f771541719f0af7dd0684e453390f16b5acb0f396b3c204bf.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd1a17ab58,0x7ffd1a17ab68,0x7ffd1a17ab783⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4340 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4452 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4076 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1464 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1444 --field-trial-handle=1944,i,17032007822539715284,2363982391163950201,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5eed808e3e5446565b70f4d7b1a908c62
SHA14809c8b3c7c9fb35c4490f816e9632563f2a8368
SHA256adaa536c6d4aec1690c20e140cc8b1a4560bb84b5414ab967a9fd0cc9db1d3a0
SHA5122f658fe73b9383b49df650e84fd53dbe3576ee91667f92db57ecdd877eb3a51497d8e385daa1656e70b00bdc4fcae645b847a4fdc1f8a95f6119feb518dec8d0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
129KB
MD5a1b40e7d8e8310fef70c83bffeac415a
SHA11cd6cec9c715117b3cfa46cd695ea56b7cb0004b
SHA256341652eae52fb6af13792a47dcd9527333c2768198ae82006c547b3891ca40b7
SHA51214e86056b52e9df1ccba76d91eedf78e8a1530bafdc04a02223525bc72303ef5b8ba11e3f783039ad03140b1639cc48c6bc59d506695f7f057b90d2e60b1555a
-
\??\pipe\crashpad_4464_TYZRIPZNGVRPITVDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1216-36-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-6-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-37-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-7-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-9-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-10-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-11-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-12-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-41-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-3-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-64-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-5-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-0-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-2-0x0000000000D11000-0x0000000000D75000-memory.dmpFilesize
400KB
-
memory/1216-1-0x0000000077EB6000-0x0000000077EB8000-memory.dmpFilesize
8KB
-
memory/1216-58-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-59-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-60-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-61-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-62-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-65-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB
-
memory/1216-4-0x0000000000D10000-0x0000000001260000-memory.dmpFilesize
5.3MB