Analysis
-
max time kernel
39s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:21
Static task
static1
Behavioral task
behavioral1
Sample
vRecording__57seconds__thc1446725.html
Resource
win7-20231129-en
General
-
Target
vRecording__57seconds__thc1446725.html
-
Size
187B
-
MD5
7dede068f87c8c6b9f8fc5a092587da1
-
SHA1
eeaf5ddcc5eeec976cbb6670a08e77b1e21befda
-
SHA256
1c8bca6fb9b0205698efd0af9269d833e84d849a3a2a20e81de1beb79ceec5d7
-
SHA512
06b6ce5c40b4366a436f2777498c244e7f6f172c406c45ed290e977219ab231a56f5e889446412be7b4f176ccb9e8f120c9c55c49584219eadb2bb16ccaed621
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506732957989377" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2824 chrome.exe 2824 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
chrome.exepid process 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe Token: SeShutdownPrivilege 2824 chrome.exe Token: SeCreatePagefilePrivilege 2824 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe 2824 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2824 wrote to memory of 2020 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2020 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2028 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2532 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 2532 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe PID 2824 wrote to memory of 4232 2824 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\vRecording__57seconds__thc1446725.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0db39758,0x7ffa0db39768,0x7ffa0db397782⤵PID:2020
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:22⤵PID:2028
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2036 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:82⤵PID:4232
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:82⤵PID:2532
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:12⤵PID:4148
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:12⤵PID:4432
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4036 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:12⤵PID:4700
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4152 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:12⤵PID:1964
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3088 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:12⤵PID:2624
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3244 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:12⤵PID:2472
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:82⤵PID:4960
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:82⤵PID:2972
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3084 --field-trial-handle=1864,i,11988109672020756094,4392853904145575606,131072 /prefetch:12⤵PID:1440
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\107c337b-dac7-4955-a5e8-8527f3a750b7.tmpFilesize
6KB
MD5f7a5f83456f2d34b418567241ea9fa78
SHA1dcbdfa0fdc243ecfb3ffa3a5b191c37186268faa
SHA256a28ffb109b9b9d5cd69d45aebe348e688c5c3d0dd8eb9385aad7a9190448c210
SHA5123f37c74413dab5599af289a8dd1fee83f5f694e60d298a2da4690c6149643a89a7de18be9c51fbf4ee8ae647a45638ed71faf44b749090071e1624ff2a0b165f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
120B
MD508daaa903f33e8e2360ab404eb31103a
SHA13c3f1129dadba7409b3e6d8f66cb98b25456b36e
SHA256d3abcf898356b92d65c97aaf601e66f06dfcdd08c86313b8dbb366d6c748df60
SHA5124d3f76ad746eff879eead3071aac6d4c899b471a87d0b438f7cb15cf7a80e312570dedd17d6a7165df0baf9d1f4cc1fcf87249aa86ac0599f55c4e8169d9d9ac
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
538B
MD550f2c0032f38a6bd086fac528db23dfb
SHA1a6f742523b18758d3050c90e8327133e38745ab3
SHA25604f044ebff5397944225d35af503dd3e5c797b454e076168081b4559f55af856
SHA51249d233420892fd6f3023fe2e8e8a010eb61fff32082c0a8c9c40aea7f381fb61372c8828cae655f5043a5733b36239d9c562cb49b13587d25879b7bdb74d56fd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD55e2722c3df792ac476778d1c41c1e028
SHA1d7ad423e34102aad18d966336e83a301a651306a
SHA2563717ca7d06df925ee1c5fae4dafd6a3de194a8d54518e1e9d632648909625b5b
SHA51264358c76d37d8f2a6ebef459ac05aa2ab270824af35efee0d56602c5cbafdfd40e2b8b8794368b23cb800ab0975ae563bab13b08d1f73ea54711c47b15e6f518
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
114KB
MD55d908d9033576a257bd567fdbcde3f93
SHA1886381021b0c162104a9b8de344624089efd1c5d
SHA256e0369f0a77a50ce1ddd4d6ea65fc39f73e2486ba7404ce98c56e2bbf9299e881
SHA512007f44c48690a784246d646117a2a1ef06b1353218d79ebd37d134cbedfc6ad2fc8cbfa294bb361e4e1000897064350ca21479ac4579875839485fb95f1a2b71
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_2824_YPPPJHVKAKCHDUSZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e