Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2024, 18:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1193221857156006078/1199739073842131035/Deef_64.zip
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://cdn.discordapp.com/attachments/1193221857156006078/1199739073842131035/Deef_64.zip
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133528440490460406" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe 4996 chrome.exe 4996 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 5076 2216 chrome.exe 44 PID 2216 wrote to memory of 5076 2216 chrome.exe 44 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 1100 2216 chrome.exe 88 PID 2216 wrote to memory of 4868 2216 chrome.exe 89 PID 2216 wrote to memory of 4868 2216 chrome.exe 89 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90 PID 2216 wrote to memory of 1700 2216 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1193221857156006078/1199739073842131035/Deef_64.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83d489758,0x7ff83d489768,0x7ff83d4897782⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1892,i,13551343053439298274,12415718740062983984,131072 /prefetch:22⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1892,i,13551343053439298274,12415718740062983984,131072 /prefetch:82⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1712 --field-trial-handle=1892,i,13551343053439298274,12415718740062983984,131072 /prefetch:82⤵PID:1700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1892,i,13551343053439298274,12415718740062983984,131072 /prefetch:12⤵PID:580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1892,i,13551343053439298274,12415718740062983984,131072 /prefetch:12⤵PID:1740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1892,i,13551343053439298274,12415718740062983984,131072 /prefetch:82⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1892,i,13551343053439298274,12415718740062983984,131072 /prefetch:82⤵PID:876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1892,i,13551343053439298274,12415718740062983984,131072 /prefetch:82⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=820 --field-trial-handle=1892,i,13551343053439298274,12415718740062983984,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4996
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f3211bb89c693d932bd3649e19cd4959
SHA1f28549b91d503ee4fbefa602cc7a63b5048d9fb9
SHA256edb8e49181004bfd60a661c6157666ec2f180c6b262b4d49d36be020d7ccdf83
SHA5126bb7f823309e0b414a6f6f080dd49f5c0d43582c6b12dc515ab0c6c6d1c07a90bb980ba8ac0314606fc83cd775217a7c4f9a9fc1165fd1d017e5d9ade022c16c
-
Filesize
1018B
MD5800e217b4d230cd052e5240b99a9c653
SHA18487ab56e8aeed7a5182baae99e69d1c669c4c7a
SHA2565295dcafcdc121a746b6f5c9d1be676919bd31803afb2de090f360fcc877a24e
SHA512f07c6150d3f443fa67cacf7a03c96c61d16d93205db9db816a1909f8f2636bf5fd73d80b17713049029fab9498b195ed3770bb95b7b2232ccd7257411cea5006
-
Filesize
6KB
MD5431f12d941da313ebafff05731a8f26b
SHA1b72c0771e83536f590afc4b9bee53c048025a99b
SHA256c281693a57a29a469a54246fba47a9a1e2f51a03253db0b180b7afb9f1c74bb2
SHA512fe5f7382278511850d03e0939fecb921cd9491183fda228da4626aa3a103472fc48c195085ee5eb2555be3667b48cb5fc05cd07d9034388ae7bfea8d83b7012a
-
Filesize
6KB
MD5c1b45035e4d9fb0aec52946b034ee0e2
SHA19dd71c7d9422d4a94c421dcb46ae3f38968fa632
SHA256c14f11dd1e802483beb4dd1689969838ce6c2ad0fc6669ff38ae5544db359835
SHA512d1948c0228a6ce7ace2c42392c8d799f7b7ae3455b4c1428cc13644b7f603d06c7695a158ecc16c40ab72a55f81fbb5476661b7d72381c7b0778253ffc02a5f7
-
Filesize
114KB
MD599ba35d64e4fd0520a7b3a23272dff2c
SHA1fbdb36c7030ca52b9b57851ac3e77fdccf4c4baf
SHA25699fc8fd1696527c92f628aa97829c1374cc855b6c3b6c8e8a4a37ddd1fc90f84
SHA5122399266970406ed023d6b54f6e92bb57281a4a2a7c7490f856e69eb335841ec257b6829b999e11f19050c406d94dbe2cc0d3e05d2618a6a9084d6f5ba6fa82b7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd