Analysis
-
max time kernel
122s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 23:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SyntaxPlayerLauncher.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
SyntaxPlayerLauncher.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
SyntaxPlayerLauncher.exe
-
Size
2.4MB
-
MD5
6ed7bb65f41915d1c9d942a5798db584
-
SHA1
e2f1dcad3c9d3396487b5e8afe20114599e0637e
-
SHA256
3efef70f965dd2b266d7bffdbe7ae1b06d62a1db7605a6aa0c5223a76e06c23f
-
SHA512
d39bbb183d8bfff9133d8eb899c25445202612277f46e18274e957bbf825c95edeb590b627bc41b52dc49dfaf3bd265d3926820120bcdc495f256d046f9a7970
-
SSDEEP
49152:zR/EhaRxfB6IyR8Iirt0GCEwBD7gV2T+:df27G0HEwRgV2y
Score
3/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1992 chrome.exe 1992 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2308 1992 chrome.exe 33 PID 1992 wrote to memory of 2308 1992 chrome.exe 33 PID 1992 wrote to memory of 2308 1992 chrome.exe 33 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 2732 1992 chrome.exe 35 PID 1992 wrote to memory of 3048 1992 chrome.exe 36 PID 1992 wrote to memory of 3048 1992 chrome.exe 36 PID 1992 wrote to memory of 3048 1992 chrome.exe 36 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37 PID 1992 wrote to memory of 2928 1992 chrome.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\SyntaxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SyntaxPlayerLauncher.exe"1⤵PID:1980
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7399758,0x7fef7399768,0x7fef73997782⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1196,i,871432491089591932,7578376827263844938,131072 /prefetch:22⤵PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1196,i,871432491089591932,7578376827263844938,131072 /prefetch:82⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1552 --field-trial-handle=1196,i,871432491089591932,7578376827263844938,131072 /prefetch:82⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2056 --field-trial-handle=1196,i,871432491089591932,7578376827263844938,131072 /prefetch:12⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2336 --field-trial-handle=1196,i,871432491089591932,7578376827263844938,131072 /prefetch:12⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2836 --field-trial-handle=1196,i,871432491089591932,7578376827263844938,131072 /prefetch:22⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2856 --field-trial-handle=1196,i,871432491089591932,7578376827263844938,131072 /prefetch:22⤵PID:2088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3224 --field-trial-handle=1196,i,871432491089591932,7578376827263844938,131072 /prefetch:12⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
987B
MD590bd960061a70e6b43e79025b5b0f413
SHA15fc4fdd3acd6f584c2e81f55d42412061559852f
SHA2562f000e8e27777ed9a456af32364f4a4ec0068bb13486728fbccacde8a346ad88
SHA512743f2594799ed7d1cc08fe11e9a739e8636a043173cbf911eb5c237e8017d33524524daf011ccb73dfac7ac0f580749efb606783137a10bb27f993a0bd6f9587
-
Filesize
5KB
MD5396674b1e381d8967a1eccd206ab5608
SHA1f41829dc6edea2ec2b133091ae60f6cf4f1201e7
SHA2561d60be1b608e0a3cbbaeb790c9e1523845c6bd6258834633a15290562b029638
SHA512ba29d165a35edf9d103a0cbeab680c4cb3c763dae381aed8e62c2a07fc350f373a679f309f9aa8e0472b03d39cbf3ba65cb4141fe5de64288f81a16cc1c29a60
-
Filesize
5KB
MD5b7545a859d0af3c7c65336954d264e99
SHA1863f50e791ec54a2cecae66055bd7c96218f3011
SHA2565f9d3e7016aa8dac7f4d8e2eb98db6ad7b2da8cbcff76c0192b6e255d8097b39
SHA512122e3ab65d14072034b7855a86223d128816210958c16f6d1c644b895a8c3d210e0067be95778389d048aae49852d41059d2bb94d146ffc9c460fb319d6eda7b