Analysis
-
max time kernel
85s -
max time network
81s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
12-12-2021 09:59
Static task
static1
URLScan task
urlscan1
Sample
https://anonfiles.com/B9Iewd00vf/VentruxApex_rar
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
ReverseSeal.exeApex.exeApex.exepid process 2128 ReverseSeal.exe 1928 Apex.exe 376 Apex.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Apex.exeApex.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Apex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Apex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Apex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Apex.exe -
Processes:
resource yara_rule C:\Users\Admin\Downloads\VentruxApex\Apex.exe themida C:\Users\Admin\Downloads\VentruxApex\Apex.exe themida C:\Users\Admin\Downloads\VentruxApex\Apex.exe themida behavioral1/memory/1928-126-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmp themida behavioral1/memory/1928-129-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmp themida behavioral1/memory/1928-130-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmp themida behavioral1/memory/376-131-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmp themida behavioral1/memory/376-132-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmp themida behavioral1/memory/1928-133-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmp themida behavioral1/memory/1928-134-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmp themida behavioral1/memory/376-135-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmp themida behavioral1/memory/376-136-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmp themida behavioral1/memory/376-137-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmp themida -
Processes:
Apex.exeApex.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Apex.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Apex.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
ReverseSeal.exeApex.exeApex.exepid process 2128 ReverseSeal.exe 1928 Apex.exe 376 Apex.exe -
Drops file in Program Files directory 2 IoCs
Processes:
chrome.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VentruxApex\Apex.exe chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VentruxApex\ReverseSeal.exe chrome.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4324 1928 WerFault.exe Apex.exe 4464 376 WerFault.exe Apex.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exeReverseSeal.exechrome.exechrome.exeWerFault.exeWerFault.exepid process 1344 chrome.exe 1344 chrome.exe 2808 chrome.exe 2808 chrome.exe 2312 chrome.exe 2312 chrome.exe 1504 chrome.exe 1504 chrome.exe 1264 chrome.exe 1264 chrome.exe 2128 ReverseSeal.exe 2128 ReverseSeal.exe 2128 ReverseSeal.exe 2128 ReverseSeal.exe 2492 chrome.exe 2492 chrome.exe 4352 chrome.exe 4352 chrome.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
chrome.exepid process 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7zG.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3816 7zG.exe Token: 35 3816 7zG.exe Token: SeSecurityPrivilege 3816 7zG.exe Token: SeSecurityPrivilege 3816 7zG.exe Token: SeDebugPrivilege 4324 WerFault.exe Token: SeDebugPrivilege 4464 WerFault.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
Processes:
chrome.exe7zG.exepid process 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 3816 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe 2808 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
ReverseSeal.exeApex.exeApex.exepid process 2128 ReverseSeal.exe 1928 Apex.exe 376 Apex.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2808 wrote to memory of 4056 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 4056 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 988 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 1344 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 1344 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe PID 2808 wrote to memory of 592 2808 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://anonfiles.com/B9Iewd00vf/VentruxApex_rar1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffef9754f50,0x7ffef9754f60,0x7ffef9754f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1540 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4100 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4552 /prefetch:82⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5800 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5960 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5984 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3096 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4212 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6024 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,13408947724048519932,10432178260869562684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:82⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\VentruxApex\" -spe -an -ai#7zMap13904:84:7zEvent169121⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\VentruxApex\ReverseSeal.exe"C:\Users\Admin\Downloads\VentruxApex\ReverseSeal.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
C:\Users\Admin\Downloads\VentruxApex\Apex.exe"Apex.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1928 -s 5243⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
C:\Users\Admin\Downloads\VentruxApex\Apex.exe"C:\Users\Admin\Downloads\VentruxApex\Apex.exe"1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 376 -s 5242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Downloads\VentruxApex.rarMD5
285526a0ced5a6d20c5ac434aa5edf52
SHA1cead42d21b30fced2b21052e64bca41941c008ee
SHA2569f03eda03da2522da4269dc396e7bf9d76f197e40f78b5a419931b4c41a68036
SHA5123a4e5b480996248c1e22bf182b97a04cd5b9c1835d2b75ea184e6bdac5ece33d7b687ce4ba0e689be8790ffae1ee27c5c4ce72b4da808e579971616ad638eb6b
-
C:\Users\Admin\Downloads\VentruxApex\Apex.exeMD5
ae0c210ec6b8ec78a9883aceada34a79
SHA14102bf3e7616e51d39a93fa38e6020b02ee347ad
SHA25614e489aedb30f0d4d0a13ec147d81d401672142934349e8366ff142ce772753b
SHA512f2a9aa4671c917db53b432433c2cd693906e65fce0094a32e6f3742d8879ab91efc8f51b94a5733556e0e446c49f28e1593269c566be534b81a75a013d1a6da9
-
C:\Users\Admin\Downloads\VentruxApex\Apex.exeMD5
ae0c210ec6b8ec78a9883aceada34a79
SHA14102bf3e7616e51d39a93fa38e6020b02ee347ad
SHA25614e489aedb30f0d4d0a13ec147d81d401672142934349e8366ff142ce772753b
SHA512f2a9aa4671c917db53b432433c2cd693906e65fce0094a32e6f3742d8879ab91efc8f51b94a5733556e0e446c49f28e1593269c566be534b81a75a013d1a6da9
-
C:\Users\Admin\Downloads\VentruxApex\Apex.exeMD5
ae0c210ec6b8ec78a9883aceada34a79
SHA14102bf3e7616e51d39a93fa38e6020b02ee347ad
SHA25614e489aedb30f0d4d0a13ec147d81d401672142934349e8366ff142ce772753b
SHA512f2a9aa4671c917db53b432433c2cd693906e65fce0094a32e6f3742d8879ab91efc8f51b94a5733556e0e446c49f28e1593269c566be534b81a75a013d1a6da9
-
C:\Users\Admin\Downloads\VentruxApex\ReverseSeal.exeMD5
60164de8def3e8973980db2db4d7bd22
SHA1391a388be8e36383a88bd5de6293ff73d2e09831
SHA2566c8cd0c14eedc541c9771fa9c39840ef2dcb76828755f3743b6141e4436392cc
SHA5127fc45fb485bf0e6905d07cc5575f46d82eeb1a1336777abd9c01c6b7faaf803791a829b0a22c9e2f3ae8ff335dd4da7a1defb71cfe3d7b61d4aa520178658763
-
C:\Users\Admin\Downloads\VentruxApex\ReverseSeal.exeMD5
60164de8def3e8973980db2db4d7bd22
SHA1391a388be8e36383a88bd5de6293ff73d2e09831
SHA2566c8cd0c14eedc541c9771fa9c39840ef2dcb76828755f3743b6141e4436392cc
SHA5127fc45fb485bf0e6905d07cc5575f46d82eeb1a1336777abd9c01c6b7faaf803791a829b0a22c9e2f3ae8ff335dd4da7a1defb71cfe3d7b61d4aa520178658763
-
\??\pipe\crashpad_2808_DASMIRWWNRHUBWFJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/376-137-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmpFilesize
10.6MB
-
memory/376-136-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmpFilesize
10.6MB
-
memory/376-135-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmpFilesize
10.6MB
-
memory/376-132-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmpFilesize
10.6MB
-
memory/376-131-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmpFilesize
10.6MB
-
memory/1928-130-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmpFilesize
10.6MB
-
memory/1928-127-0x00007FF7ACE31000-0x00007FF7ACF3A000-memory.dmpFilesize
1.0MB
-
memory/1928-129-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmpFilesize
10.6MB
-
memory/1928-126-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmpFilesize
10.6MB
-
memory/1928-122-0x0000000000000000-mapping.dmp
-
memory/1928-133-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmpFilesize
10.6MB
-
memory/1928-134-0x00007FF7ACE30000-0x00007FF7AD8C2000-memory.dmpFilesize
10.6MB
-
memory/2128-120-0x00007FFF078A0000-0x00007FFF078A2000-memory.dmpFilesize
8KB
-
memory/2128-119-0x0000000140000000-0x000000014088D000-memory.dmpFilesize
8.6MB
-
memory/2312-121-0x0000000000000000-mapping.dmp
-
memory/4228-128-0x0000000000000000-mapping.dmp