697065074b07dd0d2aa164f0587fa8ed9e593a51f1e99c11330c3567b3a715dc

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2023, 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChromiumEngine.exe
Size

648KB
MD5

dfd2c3da6d01be639d0f0996438ad371
SHA1

140e684390127cec51f8f170c46d7e427f481a33
SHA256

777a6de5bf9ce6ee373fb64501c37a3ab3202e5667762c8a0c5f72e392a14aa9
SHA512

6a91f20a75a52767d9346bb45c707f3b5c097964266fc36476668f9ec4b9775309898185874d0010d7d95db004978b6dcbe1ba6f7a5d6f29b4d6dd41290cca62
SSDEEP

6144:wpC62lkCMrK/uK6KMjwz9HKTtqlnzEKQKYwnqGsK7eOHQBcQvd:w4eCZuK6KMkz9HKwloKQK/nR7eOO1vd

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\UMPDC.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\UnityPlayer_Win64_mono_x64.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\winmm.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\Amsi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\gdi32full.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\fastprox.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\UMPDC.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\sspicli.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\rpcrt4.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\crypt32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\winhttp.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\DLL\hid.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\MMDevAPI.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\ole32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\setupapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\msctf.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\devobj.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\advapi32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\d3d11.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\wbemprox.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\setupapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dxgi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\fastprox.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\UMPDC.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\setupapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\winhttp.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\d3d11.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\msctf.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\CLBCatQ.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\Amsi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\MMDevAPI.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\oleaut32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\psapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\d3d10warp.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\CoreUIComponents.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\bcryptprimitives.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\DLL\audioses.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\rsaenh.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\sspicli.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\shcore.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\WinTypes.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\cryptsp.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\dbghelp.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\UnityPlayer_Win64_mono_x64.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\rpcrt4.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\shcore.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\dxgi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\MMDevAPI.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\powrprof.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\msvcp_win.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\WLDP.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\iphlpapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\Amsi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\sechost.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\DLL\audioses.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\ResourcePolicyClient.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\ws2_32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\dll\dxgi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\system32\gdi32.pdb	ChromiumEngine.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dll\win32u.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\winhttp.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\CoreUIComponents.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\bcrypt.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\shell32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\shcore.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\Amsi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\UMPDC.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\setupapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\exe\WindowsPlayer_Master_mono_x64.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\gdi32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\sechost.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\user32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\WLDP.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\d3d10warp.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\user32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\Kernel.Appcore.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\wbemsvc.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\WinTypes.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\bcrypt.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\imm32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dxgi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\wbemcomn.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\winmm.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\gdi32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\gdi32full.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\Windows.Storage.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\shlwapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\msctf.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\crypt32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\opengl32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\dwmapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\DLL\psapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\cfgmgr32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\version.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\psapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\WLDP.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\gdi32full.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\msvcp_win.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\oleaut32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\wbemcomn.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\ntmarta.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\powrprof.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\UMPDC.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\combase.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\ws2_32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\DLL\hid.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\profapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\MMDevAPI.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\glu32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\dxgi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\dll\dwmapi.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\dbghelp.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\ole32.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\dll\d3d10warp.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\symbols\DLL\audioses.pdb	ChromiumEngine.exe
File opened for modification	C:\Windows\WinTypes.pdb	ChromiumEngine.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3756	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3552	ChromiumEngine.exe

C:\Users\Admin\AppData\Local\Temp\ChromiumEngine.exe
"C:\Users\Admin\AppData\Local\Temp\ChromiumEngine.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3552

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3552-0-0x000002B76F690000-0x000002B76F6A0000-memory.dmp

Filesize
64KB

Download
memory/3552-1-0x000002B76F560000-0x000002B76F570000-memory.dmp

Filesize
64KB

Download
memory/3552-2-0x000002B8D32D0000-0x000002B8D32F0000-memory.dmp

Filesize
128KB

Download
memory/3552-3-0x000002B8F4990000-0x000002B8F49A0000-memory.dmp

Filesize
64KB

Download
memory/3552-4-0x000002B8F4550000-0x000002B8F4560000-memory.dmp

Filesize
64KB

Download
memory/3552-5-0x000002B8F4560000-0x000002B8F4570000-memory.dmp

Filesize
64KB

Download
memory/3552-7-0x000002B8F45C0000-0x000002B8F45D0000-memory.dmp

Filesize
64KB

Download
memory/3552-6-0x000002B8F45B0000-0x000002B8F45C0000-memory.dmp

Filesize
64KB

Download
memory/3552-9-0x000002B915670000-0x000002B915680000-memory.dmp

Filesize
64KB

Download
memory/3552-11-0x000002B9166A0000-0x000002B9166B0000-memory.dmp

Filesize
64KB

Download
memory/3552-10-0x000002B915680000-0x000002B915690000-memory.dmp

Filesize
64KB

Download
memory/3552-8-0x000002B915610000-0x000002B915620000-memory.dmp

Filesize
64KB

Download
memory/3552-17-0x000002B8F4560000-0x000002B8F4570000-memory.dmp

Filesize
64KB

Download
memory/3552-21-0x000002B915610000-0x000002B915620000-memory.dmp

Filesize
64KB

Download
memory/3552-20-0x000002B76F690000-0x000002B76F6A0000-memory.dmp

Filesize
64KB

Download
memory/3552-19-0x000002B915670000-0x000002B915680000-memory.dmp

Filesize
64KB

Download
memory/3552-18-0x000002B8F45B0000-0x000002B8F45C0000-memory.dmp

Filesize
64KB

Download
memory/3552-16-0x000002B8F45C0000-0x000002B8F45D0000-memory.dmp

Filesize
64KB

Download
memory/3552-15-0x000002B8F4550000-0x000002B8F4560000-memory.dmp

Filesize
64KB

Download
memory/3552-14-0x000002B8F4990000-0x000002B8F49A0000-memory.dmp

Filesize
64KB

Download
memory/3552-13-0x000002B8D32D0000-0x000002B8D32F0000-memory.dmp

Filesize
128KB

Download
memory/3552-12-0x000002B76F560000-0x000002B76F570000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads