Analysis
-
max time kernel
1049s -
max time network
1049s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2024, 21:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TheDevourer.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
TheDevourer.exe
-
Size
322KB
-
MD5
d9cdce8161bbcd1de0ac5a7b8bfafcbc
-
SHA1
708dbd6ee36c53f1ab5b6413083e21950b1885d4
-
SHA256
d1f9d538b4af852dfaf52d0fefa421d02e6efd2e6d4714257c1075e6c53c7928
-
SHA512
5d4a6ac11fd3029e2802abdfbb8b35d6910b513958170222d3a340e95831f972cd056ccc00b7857ded3fdd081cd2d144d30467b9120257bb4789a8f6c8687539
-
SSDEEP
3072:U85tt3PY3TrQdVHqtdy1sZevANyBunsTBQ4J1wamcKJ5UIrJIssWc5eQLvo0EUVL:7lI4dVWdyklkiMQWPi5xtcpLBEUV9Ay
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133487911405285255" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3600 chrome.exe 3600 chrome.exe 3252 chrome.exe 3252 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3600 wrote to memory of 3456 3600 chrome.exe 123 PID 3600 wrote to memory of 3456 3600 chrome.exe 123 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 1240 3600 chrome.exe 126 PID 3600 wrote to memory of 5036 3600 chrome.exe 124 PID 3600 wrote to memory of 5036 3600 chrome.exe 124 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125 PID 3600 wrote to memory of 4820 3600 chrome.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\TheDevourer.exe"C:\Users\Admin\AppData\Local\Temp\TheDevourer.exe"1⤵PID:2520
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\TheDevourer.exe"C:\Users\Admin\AppData\Local\Temp\TheDevourer.exe"1⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\TheDevourer.exe"C:\Users\Admin\AppData\Local\Temp\TheDevourer.exe"1⤵PID:4948
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff82e309758,0x7ff82e309768,0x7ff82e3097782⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:82⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:82⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:22⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:12⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:12⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4256 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:12⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4876 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:82⤵PID:904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4892 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:82⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:82⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:82⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5188 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:82⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4116 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3140 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:12⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=244 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:12⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3428 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:82⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5148 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:12⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4112 --field-trial-handle=1880,i,69818503583904331,234584837365375430,131072 /prefetch:12⤵PID:2712
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5555e2f347a59e8a7a92932cd19809211
SHA1551cf66cdc0c03077b3a408cd3aa572d275a55ba
SHA2563ab535edb9e7bb572788a56fe2895728d499efc8daa2d786fce5fe1cb6a68399
SHA512af0ecdffdcb7d4d20ef9dabc39bc11370eb0480d1628182ac176544e73e131d12414557e47aae7b13f9c8b10c0768fe0bfa227dd2ede1db7ac7b1df3d511b926