Resubmissions
16/06/2024, 14:33
240616-rw8hms1cmm1016/06/2024, 09:53
240616-lw4xkasfmp115/06/2024, 21:30
240615-1chmjsygrj415/06/2024, 17:50
240615-wevmnsyhrh115/06/2024, 17:33
240615-v4592asfmp115/06/2024, 17:29
240615-v2rzmaydrb115/06/2024, 17:25
240615-vzhceasdqp115/06/2024, 11:35
240615-nqd53aygkc115/06/2024, 11:34
240615-npsxtssgpj115/06/2024, 11:34
240615-npsl3asgnr1Analysis
- max time kernel
599s - max time network
588s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 11:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://j6lyat060624q67.xyz/08f10c664042c174f24981a4ec6e3b3e4105598b_1718450383/file-dln_666d78cf14318/?source=12&grp=17&file=&q=Bandicam-7-1-1-2158-with-Crack--RePack---Portable-
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
600 seconds
General
- Target https://j6lyat060624q67.xyz/08f10c664042c174f24981a4ec6e3b3e4105598b_1718450383/file-dln_666d78cf14318/?source=12&grp=17&file=&q=Bandicam-7-1-1-2158-with-Crack--RePack---Portable-
- Sample240615-npsxtssgpj
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133629797040644329" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 212 chrome.exe 212 chrome.exe 2064 chrome.exe 2064 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 212 chrome.exe 212 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe Token: SeShutdownPrivilege 212 chrome.exe Token: SeCreatePagefilePrivilege 212 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe 212 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 212 wrote to memory of 3452 212 chrome.exe 83 PID 212 wrote to memory of 3452 212 chrome.exe 83 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3012 212 chrome.exe 84 PID 212 wrote to memory of 3392 212 chrome.exe 85 PID 212 wrote to memory of 3392 212 chrome.exe 85 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86 PID 212 wrote to memory of 2888 212 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://j6lyat060624q67.xyz/08f10c664042c174f24981a4ec6e3b3e4105598b_1718450383/file-dln_666d78cf14318/?source=12&grp=17&file=&q=Bandicam-7-1-1-2158-with-Crack--RePack---Portable-1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b214ab58,0x7ff9b214ab68,0x7ff9b214ab782⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1864,i,8291241063347483437,16584049044970683069,131072 /prefetch:22⤵PID:3012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1864,i,8291241063347483437,16584049044970683069,131072 /prefetch:82⤵PID:3392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1864,i,8291241063347483437,16584049044970683069,131072 /prefetch:82⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1864,i,8291241063347483437,16584049044970683069,131072 /prefetch:12⤵PID:3764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1864,i,8291241063347483437,16584049044970683069,131072 /prefetch:12⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4288 --field-trial-handle=1864,i,8291241063347483437,16584049044970683069,131072 /prefetch:82⤵PID:936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 --field-trial-handle=1864,i,8291241063347483437,16584049044970683069,131072 /prefetch:82⤵PID:3700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=992 --field-trial-handle=1864,i,8291241063347483437,16584049044970683069,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2064
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 120B
- SHA256 ffb50ea29ab2b2d46547f74e9dc17a6193ae37503d738cdd1d3ba3cc2f4b7b43
- MD5 833379c281b34403bcb7ebc48794178b
- SHA1 92b612e82762ee5e31707575fd7a74ed80fda3ad
- SHA512 adb2f49455f86e178868e30ea4e7c31259427b7a676678a72b5ab182888da77e9194e25544ddbed449e1c6128b3f23cf4b23e8fad6123e639bde1749ba69c323
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 c4924553c8cb480fab77ed8796ebab8fab32d7812ba91e50689d422723e0b6ab
- MD5 7a6184bb6b6a4238e1a56004a636af94
- SHA1 3d73fb5704ef591bf8a8987a633e15777cb3333a
- SHA512 8e0f66f7209bca03db137531f7708c5d9e5674865109f5adcc85cd2288660b87aa9d258cb7bba5104e41e7ff0f530747ca08e58bc0a0b9b095d89c2f97801118
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 691B
- SHA256 eb05543eedb0dae6babe45c7a4f0f55256d470154f77cb0e3dfd7476ca983077
- MD5 c3aa4c16e9cfba1d33dd29ba09ae245e
- SHA1 9da2789f4090e97bf58e40dc0ff1f81abedcd64d
- SHA512 2e6d01312bc4e35e9148abbcb842daa9ac01b7f8471e96741b804e9e43e95e0b8077b4adaf8c5e2a5a562ed3fff190f02b5ea2aaea694e15380fa3b8dcde31bf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 a2a97aa532c8410b5929be7e7a65d7357f528600bec5c353b55a6350416485ea
- MD5 170b6cc76d7d7c3a848f28b5fb38a7f2
- SHA1 145911214f02aa5b0088fd8fff11fb179839e2a6
- SHA512 637407d8d2d2c03e6b92ca4e7cd577e2ffebc1b4aab7b8dd18ed891dfdef7801b990014b97c9ca3d9ec6fe0d7e84b41d03a447bdf5fcc716533e07a46609925d
- SSDEEP 192:JYoTCCNaJhSpQm8syh+FP8UoJ+nP5tjEsXtScR:JYoTlwcpyqUUo4xtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 138KB
- SHA256 d8073fb7df8a0d23c4f04962f92836235dfd156e0e143956414cb4eaadd05d9a
- MD5 174810f655550a73d3691e1f212c1464
- SHA1 918ca088ba153a4fb545cde976e7178df3e3f9c8
- SHA512 a3ccc2bf407c8b91ec70d56467d9b6ac17c01558ba2ecfde2a2eab894b985eff6c6992e55830963ed822e6dbcda8c7a6ca244fa7a44469d48f587373b1eb85c3
- SSDEEP 3072:m3cMw24LQfn5MY4R3q3m0qPaNjDpwU5mVXw8:fMw5Qf2RSTIadDpwU5CA8
- MD5 SHA1 SHA512 SSDEEP