614a723a76e12843d611815ffa1d5978ede6fec46362599ec5d5be8dae625d77

Analysis

max time kernel
20s
max time network
52s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-08-2024 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0806(4).mp3
Size

59KB
MD5

96ada4fdc1cc1fcb1d234f7b96a74adc
SHA1

0a8d1806c8de52afbd7607c68d2c575f52a7fef5
SHA256

614a723a76e12843d611815ffa1d5978ede6fec46362599ec5d5be8dae625d77
SHA512

5dea7b2fbf0a7e8a04cd4f56806e7766aeb5d2d5a03edbfcfcf66ca36d3d580a285e15f4886ca7ce88ddde8ab2adf2168d101a95bfc884c50beafc250c7a7550
SSDEEP

768:dEHysnynMjJh601ZQOSkG2E8juVtqKoI/5cMEjIwJRrqmLRAJc+u1PdcPB6qTLIJ:uS3MW0IzPCKcJfNVqc+u1Pdcz2n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1828	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2812	chrome.exe
2812	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1828	vlc.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: 33	1828	vlc.exe
Token: SeIncBasePriorityPrivilege	1828	vlc.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
1828	vlc.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1828	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2740	2812	chrome.exe	31
PID 2812 wrote to memory of 2740	2812	chrome.exe	31
PID 2812 wrote to memory of 2740	2812	chrome.exe	31
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2132	2812	chrome.exe	33
PID 2812 wrote to memory of 2360	2812	chrome.exe	34
PID 2812 wrote to memory of 2360	2812	chrome.exe	34
PID 2812 wrote to memory of 2360	2812	chrome.exe	34
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35
PID 2812 wrote to memory of 1996	2812	chrome.exe	35

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\0806(4).mp3"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6af9758,0x7fef6af9768,0x7fef6af9778
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1368,i,887316513181092205,8163073860862478956,131072 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1368,i,887316513181092205,8163073860862478956,131072 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1368,i,887316513181092205,8163073860862478956,131072 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1368,i,887316513181092205,8163073860862478956,131072 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1940 --field-trial-handle=1368,i,887316513181092205,8163073860862478956,131072 /prefetch:1
  2⤵
  PID:604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1464 --field-trial-handle=1368,i,887316513181092205,8163073860862478956,131072 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3224 --field-trial-handle=1368,i,887316513181092205,8163073860862478956,131072 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 --field-trial-handle=1368,i,887316513181092205,8163073860862478956,131072 /prefetch:8
  2⤵
  PID:2184

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
79b27ec63c88d25aa89c244d6993e6e4

SHA1
d98918fcf5a47c24e5267480aaa98d0d400f4b25

SHA256
6fbf8af7b3270e6c3fc34cadd1b6df0ab6f7610ac30a2a391ed5baa2fe54417d

SHA512
58973efad554e9fa867b9cf099ea42452d981263ccafbab98f9b04678dd15e5bab3489be7543ba5a9e4c6467a658cff82a0c59d0f0989f33ea6b75435dd739b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a2ad9fb6e50fdeeb990009b169e96a83

SHA1
1f35f437f2797fbd6d1763272494bd3a4e5e1687

SHA256
79cd411b5e88c9e9ba3e576b83a0083ca8e43e4a347ea9a67dda3d3881f62034

SHA512
d4c398a1fbc9f65c686d639b5d69fc9b5716f1e6a26dc17479502986de71d2fa8ddb4f47df2a38c996824acc6c0a1ae54448afcf7ff628f09b21236dbbae0277

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
memory/1828-13-0x000007FEF7510000-0x000007FEF7544000-memory.dmp

Filesize
208KB

Download
memory/1828-12-0x000000013F380000-0x000000013F478000-memory.dmp

Filesize
992KB

Download
memory/1828-14-0x000007FEF5D20000-0x000007FEF5FD6000-memory.dmp

Filesize
2.7MB

Download
memory/1828-15-0x000007FEF4C70000-0x000007FEF5D20000-memory.dmp

Filesize
16.7MB

Download