e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
28/06/2024, 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
Size

2.3MB
MD5

d06913fbee09bdfe1bb7cbb2b392c798
SHA1

127509ec2204bd8d16ce2355038755a0c53b01f7
SHA256

e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8
SHA512

18ae838dae507696a118cd8caacdc38230c20df15679e76b9490f5738b2eb742a161dd587a78d63d3f5bf0a90aac4ee9a4a2aa8fff164482709e6d1f945ad2d0
SSDEEP

49152:ZOC4iuI0MHyCRKsvOqoOuVDZ+bpBgNGOeOq068eNtGeZFLEKpZIYtB0Ck:ZOC4iuI0B9GVBgNGONiFikxEyb0C

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/676-4-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-3-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-5-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-6-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-8-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-9-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-42-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-63-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-64-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-65-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-66-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe
behavioral2/memory/676-67-0x0000000000620000-0x0000000000B6E000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133640455261840647"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
884	chrome.exe
884	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
4452	chrome.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
4452	chrome.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 4452	676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe	77
PID 676 wrote to memory of 4452	676	e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe	77
PID 4452 wrote to memory of 3476	4452	chrome.exe	80
PID 4452 wrote to memory of 3476	4452	chrome.exe	80
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 800	4452	chrome.exe	81
PID 4452 wrote to memory of 4548	4452	chrome.exe	82
PID 4452 wrote to memory of 4548	4452	chrome.exe	82
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83
PID 4452 wrote to memory of 3000	4452	chrome.exe	83

C:\Users\Admin\AppData\Local\Temp\e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
"C:\Users\Admin\AppData\Local\Temp\e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcbccaab58,0x7ffcbccaab68,0x7ffcbccaab78
    3⤵
    PID:3476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:2
    3⤵
    PID:800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:8
    3⤵
    PID:4548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2144 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:8
    3⤵
    PID:3000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:1
    3⤵
    PID:2728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:1
    3⤵
    PID:232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:8
    3⤵
    PID:3348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:8
    3⤵
    PID:4632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4288 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4528 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:8
    3⤵
    PID:2444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3948 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:8
    3⤵
    PID:1504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:8
    3⤵
    PID:860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4624 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:1
    3⤵
    PID:3308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4212 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:1
    3⤵
    PID:8
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4728 --field-trial-handle=1856,i,8908923583719774164,5882103225184747676,131072 /prefetch:1
    3⤵
    PID:3420

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:72

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
fb601a5727e304db780c485ef17e0652

SHA1
ea766a59e34e34f12cd70a4d9ee125eb3c7a7fc2

SHA256
27043385b239ce3a62d9ac2cf60c904f11c0392be8f2ac589189b8ceb1b991b4

SHA512
7f524de1c369f534aa383bfa56590bae2f6f45cc1927e0598d74b1fc98dc69e32458fb8aa09062f7bca641add2d5b57705d1e3ac8593759d70c832ded6b4387b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
e758917b3dc640fc99730fabd1f9fb1d

SHA1
e7e3bcb7d1bbd02bb977a271c5933faafab721cf

SHA256
6cdd3f4d0498ad864e249cc3e1b9b31175a640671b7c846c1710ac9a15e3baf1

SHA512
f355b41ebcb5b6fa34f2ee46a46d039fcf0017333552b96de012863c981d766c63f145977ae1b431deff0b275a07c072a0b040d7fe4dcb6dc97a81ca6753a6ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
30bae59dafc347ce1a75df1e7d79b606

SHA1
c59d0962e89fd2e00c21ae2d253891ce0880a39c

SHA256
517c76355c61edb76abc11c4d90a12b8526262a9a7118e166e33ac86ff7780b6

SHA512
b6d356656dd17df3664ca12fc4e6af6ae7b993a3d00bd8a6e3a84e70ed08f3acc5fb88349656b43df4ccccbd2e9f7549d3f05ddf8a5b9cdba6f499fd892a2e4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
86KB

MD5
44937b33cfc0dd7aa8b1617e5b09a9a5

SHA1
d798fa15edee94bbf12c69b678586a6332d077fe

SHA256
e209da637877714654add734fa230619c95dcbdfd05f0a15ba24067a5cdb35bb

SHA512
e1d91e8d036ba399ce585aa97daa834a2cdca9a202d5fa17b6eea865ae7617d81263de065ce0be1e120ebdaa9682fcd1ac8dffbd4688c835fa533f9633b5da2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe581279.TMP

Filesize
83KB

MD5
9bac6a7744e45171e55e4ee749e0265e

SHA1
b0cdbfbdf79dac887a84d663f4425d2226a8e74a

SHA256
fb134ffa22bac13b0fb0fd722e33f8c9d0bac03532aad73e262c49880179a94b

SHA512
4c9497fd2065eedc2201b0f0fa7119d33f2e6c6554d3a19977686078726d9503a78bb1e2648cddb0f99a7662163d899dfbcb44f81e80d2d8ef2dd52846502a02

Download Submit
memory/676-5-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-2-0x0000000000621000-0x0000000000685000-memory.dmp

Filesize
400KB

Download
memory/676-8-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-6-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-0-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-42-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-3-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-9-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-63-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-64-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-65-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-66-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-67-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-4-0x0000000000620000-0x0000000000B6E000-memory.dmp

Filesize
5.3MB

Download
memory/676-1-0x0000000077756000-0x0000000077758000-memory.dmp

Filesize
8KB

Download