Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2023 01:14
Static task
static1
Behavioral task
behavioral1
Sample
Super Mario 64 (USA).n64
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Super Mario 64 (USA).n64
Resource
win10v2004-20220901-en
General
-
Target
Super Mario 64 (USA).n64
-
Size
8.0MB
-
MD5
165a9558b7539507e73e7afecffb200c
-
SHA1
1002dd7b56aa0a59a9103f1fb3d57d6b161f8da7
-
SHA256
f3b0fc9f565f995368b6fa5aefc8ec1e5194c488948b41f3534dece4abcec2b4
-
SHA512
c85c207181238bf98b14db54e97a3c09df7e4e1841dc1f9050edcc6525e99e5ffa6fccddfd5911e7ea87ff0625cf9e61cb375a7638bc39820e4e4b55ff45b369
-
SSDEEP
196608:+j+nhu7LwRIs/Rk56N0968W1YE3BFnph8zAP:FnhEUms/65X96bmE3BFn8zAP
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exepid process 1916 chrome.exe 1916 chrome.exe 2396 chrome.exe 2396 chrome.exe 1776 chrome.exe 1776 chrome.exe 2400 chrome.exe 2400 chrome.exe 2820 chrome.exe 2820 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
chrome.exepid process 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
chrome.exepid process 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3388 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2396 wrote to memory of 3976 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 3976 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 2264 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 1916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 1916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe PID 2396 wrote to memory of 4916 2396 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Super Mario 64 (USA).n64"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaa8fc4f50,0x7ffaa8fc4f60,0x7ffaa8fc4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2044 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2320 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4668 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4776 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4812 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5400 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5396 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5476 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5596 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5744 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5520 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5512 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5628 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4648 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1568 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1664,14777535878090424130,10720468486720616051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4456 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\crashpad_2396_TOPBDBENPIIBOIOIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e