Analysis
-
max time kernel
1799s -
max time network
1690s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03/04/2023, 08:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://geo.dailymotion.com/player/x8v0l.html?video=x8jnojl&mute=true&loop=false
Resource
win10-20230220-en
General
-
Target
https://geo.dailymotion.com/player/x8v0l.html?video=x8jnojl&mute=true&loop=false
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133249907711377743" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3796 chrome.exe 3796 chrome.exe 4292 chrome.exe 4292 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: 33 536 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 536 AUDIODG.EXE Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe Token: SeShutdownPrivilege 3796 chrome.exe Token: SeCreatePagefilePrivilege 3796 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe 3796 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3796 wrote to memory of 4320 3796 chrome.exe 66 PID 3796 wrote to memory of 4320 3796 chrome.exe 66 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4604 3796 chrome.exe 68 PID 3796 wrote to memory of 4616 3796 chrome.exe 69 PID 3796 wrote to memory of 4616 3796 chrome.exe 69 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70 PID 3796 wrote to memory of 2280 3796 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://geo.dailymotion.com/player/x8v0l.html?video=x8jnojl&mute=true&loop=false1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0x44,0xd8,0x7ffdc45e9758,0x7ffdc45e9768,0x7ffdc45e97782⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1740,i,17718002792080789431,6390423464916046216,131072 /prefetch:22⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1704 --field-trial-handle=1740,i,17718002792080789431,6390423464916046216,131072 /prefetch:82⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 --field-trial-handle=1740,i,17718002792080789431,6390423464916046216,131072 /prefetch:82⤵PID:2280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1740,i,17718002792080789431,6390423464916046216,131072 /prefetch:12⤵PID:1328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1740,i,17718002792080789431,6390423464916046216,131072 /prefetch:12⤵PID:1088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4684 --field-trial-handle=1740,i,17718002792080789431,6390423464916046216,131072 /prefetch:12⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 --field-trial-handle=1740,i,17718002792080789431,6390423464916046216,131072 /prefetch:82⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1740,i,17718002792080789431,6390423464916046216,131072 /prefetch:82⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5392 --field-trial-handle=1740,i,17718002792080789431,6390423464916046216,131072 /prefetch:82⤵PID:616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4588 --field-trial-handle=1740,i,17718002792080789431,6390423464916046216,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4292
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3712
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2b41⤵
- Suspicious use of AdjustPrivilegeToken
PID:536
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480B
MD5667a5d670a0dc3f2bfb0898ea563cc17
SHA1b0df44e7fe539a990486d856b64964b9dca89d47
SHA2569e4aadd5789afc4a8c6a1f10ffce04a76339326b30cb4e0d0662c26bfbb2e353
SHA5128b5dbd9c700c3db651a7631eef38cb4be2490b37a4bfb8ad842e9a550f49f8cba6c94bc006034484a9b1b9d4abce9e34016358780c5c5f0a532eccc5717f2f5f
-
Filesize
2KB
MD5454a27ceed064b1d64b6be2b60634fcd
SHA1bce5ace5332cd182999a8efdc97c94c7862aad77
SHA25626aa8bc3ae179616ab13672b604ab6cc16e8de07b301e525286ac6bef421c718
SHA512cfd6a08489579016c8d91fac41bd41ffa30b2374a8750ebaa2b0ef5d0260857db3753be5de55d10027cc601d9ab0f02db17d6cd0c57c58f3bc1b707669db1a22
-
Filesize
1KB
MD5e38482f79ef680d1d0ae7e539a65e4d7
SHA10b55a51733f57755508b31f4267f7d426f795223
SHA2569153baae71e70bc593b74db520974773f367588d9e705fcba1372bf64a986b31
SHA512c23b0df9b61821b21d7484008c131c857494cfabdbe6894d18eb5f021ab26a39001e943d80cdc968b7769a74265ad432217c150c0a4787626578c9df06723c34
-
Filesize
1KB
MD5a616e45d0f46c908268353dedb4e72cf
SHA11003528292c1951b5eb22b6258f27437b46fee41
SHA256405ed840a0ec398290fbbd72ab83347c136cf1bae5afc29fef8f2b8466351ec9
SHA5122a911170b22673e8c587984a30090cca4ab85e8e2282394f397d863801e22aaaee27af6da989539fd839f000202785156f94ea12e3e5d5ce6de7443bf3e4248d
-
Filesize
5KB
MD5558e9817cad521e096fddb7ffc43dfaf
SHA1a30ef458ca94c23c57916fd8055c2945820aa85b
SHA256fa81c783876e1ad0346bf697fa4e30c360fd17be5a6bbe0fd4d8d6637bf3d470
SHA512197e1d798f1c595bd05ccd72f46f229ed2bd197b911138f3961889120a516a830913ff6fb3fa37e59835462877ce1614b11aa77915c8817bdd108a6cde269362
-
Filesize
5KB
MD593c59d6d6483c2ee55c46db24e29231e
SHA1617b02e00769f247c2398e0b013a3ef2fe5d8d89
SHA256389e8a42a86e38529216bccca0db310266dbbe69941e0d355181c89463ef0ea1
SHA512a93fd2729324292e8d0f3ae6b48cac46bcdf603b8791dd8d0169229114647eb229c12e6a19870672d45ab939b98bff1d313ceca800cfddbc23670388616f3643
-
Filesize
6KB
MD54f62ab76d4a8ff71a62765a56b7b6532
SHA171eeb82134db7a61419ece58ed93eb31b8571467
SHA256fc80a701f59d1154441c9889316c3e79337506641c15cfad3f81095ce10f624f
SHA512afca706fce4f3a8e0abd63d7862d4f3cd7d9d3ff3ea6697b5ae26c48ef4db76d73f8c1adffd54227ec1dffe3f6d9d80adc7d15d0ac2b5518e132145b57bbc85b
-
Filesize
174KB
MD511934588822d6cd06ac4eb78a290ae49
SHA19ea53dc3e5b5ba35463cf5a869a932214e5b5c77
SHA2568d1e59a9dbc88d2cefceada5053ed347c30ba399464d36ebb321cc08f7a9146b
SHA512766c68aec465ec5e5b74bdac27b193348b427657cdaacf6501f9f696b6c04de8add9a1504b8f13259a2d75d6e605257d073c9026a98d86612880b2a4448192e6
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd