Analysis
-
max time kernel
54s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
MacroRec.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
MacroRec.zip
Resource
win10v2004-20240508-en
General
-
Target
MacroRec.zip
-
Size
45.3MB
-
MD5
8323050f437b9d8606f9762147232644
-
SHA1
330283f39f515ed9360330627a7dd4a24f2dde66
-
SHA256
6000f0b0b91f12aae6e4250c79b1a682b50fd0236dcfba9b4157f34c205dc192
-
SHA512
18807a0c74d026fb4fcb19723f7604da8b0ca1faea39a25b94bcdd37282bff1484a2a782ede0770f6fb107817800a12ddb4b84e5f131e209563c8ebfd2b3fe47
-
SSDEEP
786432:xW9YuYz6mivrEs9MgOh0uoxHH2hJQsQxIKEKl/pITrgkNaCd+gawivwt9p7TTu:mWivr79rsEx2fU+Knl/wrgkNax5+ny
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133611123981460033" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 3956 4580 chrome.exe 94 PID 4580 wrote to memory of 3956 4580 chrome.exe 94 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 3700 4580 chrome.exe 96 PID 4580 wrote to memory of 2684 4580 chrome.exe 97 PID 4580 wrote to memory of 2684 4580 chrome.exe 97 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98 PID 4580 wrote to memory of 4184 4580 chrome.exe 98
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MacroRec.zip1⤵PID:1684
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee96aab58,0x7ffee96aab68,0x7ffee96aab782⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:22⤵PID:3700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:82⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:82⤵PID:4184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:12⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:12⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4328 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:12⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4472 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:82⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4284 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:82⤵PID:3640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:82⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4788 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:82⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:82⤵PID:4640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:82⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:82⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1908,i,43312041953466797,329231318357821256,131072 /prefetch:82⤵PID:3320
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1968
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5f47258a53c4c848bc97e65b5879cbe05
SHA1d47d1ae51f91ef98a26ffcb545283d1eab015277
SHA25681bd28b5284fafafbc4914e55790ee2531332c23b66c4c64702e795f09870867
SHA512afbb06e9779be04cee04b78c4fa58beb453b55cad6582895c0005437bd7e5f1fc23aff8da4151a03d6061b6d7906fcecaf65f3396ff3f840bd590002d2b08a3d
-
Filesize
6KB
MD5126c189834fd9e5d5e49789417368d33
SHA1bda5ad07a1c245c6e25ac4b04d4cd460b42b6ecc
SHA256f6831d643b4886786382e563720d87c2b0481de87097e553bbd71a939d1bb4f1
SHA5122f11d0aba53c1102e2b7b2d772a1e6bc7b77d17ac138c2a177805ce48e3f2dad5b01361d97bd5b8749550e2c377bb96e6c22360c5c6ed8edb84d936a805973d2
-
Filesize
16KB
MD548914f0e029fe9acdf3969c17100a9ab
SHA1c0c41a0b4a6ae501295ffc227c25c05b64915640
SHA256b7dbbc060edb08921197a679b84e6ccffaadebcbb280b1e70b3175b3da18be7a
SHA512adeb29e150568e2d44ef2451059257fbd659dcabc00bf790d148f94aba4dfe90158814ce751b4a232433c679dbee00e316459b22fcc7ed2dde9ab1043edb407a
-
Filesize
257KB
MD50b97f9091d7f65994ef33e6ddcf27688
SHA16d1038409ecdc8bb9b3e9eb51f6e253c466d122d
SHA25626dc5d4c4272318614b7ef84bb7865f2162ce3a6e9891733e9c37107ee1ecb03
SHA512134ef814d11c7d20f6779d27e958d7057b9e7e4424fb4e3171de7b95346972719757adde35cf1173c8b8fe0d30e36d32df5271cb93a31c296f05d7fe5ebb8db1
-
Filesize
262KB
MD5ccf4da3b402271c03760db93e8846dbe
SHA155fd099fda1446f8ee9bed16e3847a3b625f4e11
SHA2566ee1e4af9d4912e47363a7d4f385d49a662b4fdd03875bae3aeec6c0e98fc057
SHA51282afafeb97c8f20ad3b1f582786383597d046ab48891cedd41d083377208d577e971368b6fd9e894de93c9244854b6a38573b9763173b70280d425a18d221c62
-
Filesize
91KB
MD5906627f0cc49e8b2b562ae0be0912d54
SHA1fb94e69145434b0710b7e73acaef89473e894b24
SHA2568a507ec444c8221c73843467ba5c4d533add4c83c8f9ee804ba1e696cc0ad46f
SHA512fe9a612eb5e398e98c2f540e4eb0ee59f9093641a2604fe876f3c226f1e364b662223554a08e110fb0858f3ea19e05019dbfdf7756b2ebf2215cc783963ae79c
-
Filesize
88KB
MD598d5966b0682ae4b70c0c64be04325da
SHA17ac3c2104fe52b81ea3ef68e37d3ae51e91906d6
SHA256315534ce0f2089dbdfde918062298a0ef47f6347606af4f42aa94a0043d2d44f
SHA5122ef3a752dae715dca96278f6f969c15cd31a65dea8eba9b3819963f2b5bd12c6ca28e33864d4828ad3207c1f98479c0b26fdc4ab5c5891e7e26faa766623f238