Analysis
-
max time kernel
46s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 02:13
Static task
static1
Behavioral task
behavioral1
Sample
Valorant-Checker-Fullcapture
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Valorant-Checker-Fullcapture
Resource
win10v2004-20240802-en
General
-
Target
Valorant-Checker-Fullcapture
-
Size
272KB
-
MD5
5830d546b30df6a9c2abbb62e91f9e13
-
SHA1
ddb872ac33a24098b58cd1c956f756282fbe18a5
-
SHA256
f41fa8efa47d4db7b90c31688a1b965d35558ec625984dfca9b3825c8a36a9ad
-
SHA512
6113ec1a4e10409495f5bbfd66d870c4bd6ff36ab43459ff70110f4d2dc5e104a9410f54af4021b6b137d48f63e40ab348a01544e967f6daa7e3ac57ffb5af1c
-
SSDEEP
6144:u0oY73uokeOvHS1d1+sNs8wbiWQx9XvZJT3CqbMrhryf65NRPaCieMjAkvCJv1V/:voY73uokeOvHS1d1+sNs8wbiWQx9XvZu
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2136 chrome.exe 2136 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2916 2136 chrome.exe 32 PID 2136 wrote to memory of 2916 2136 chrome.exe 32 PID 2136 wrote to memory of 2916 2136 chrome.exe 32 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2940 2136 chrome.exe 34 PID 2136 wrote to memory of 2776 2136 chrome.exe 35 PID 2136 wrote to memory of 2776 2136 chrome.exe 35 PID 2136 wrote to memory of 2776 2136 chrome.exe 35 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36 PID 2136 wrote to memory of 2684 2136 chrome.exe 36
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Valorant-Checker-Fullcapture1⤵PID:1916
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7b19758,0x7fef7b19768,0x7fef7b197782⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:22⤵PID:2940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:82⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:82⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2360 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:12⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2480 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:12⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1164 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:22⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3224 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:12⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2788 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:82⤵PID:1572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3976 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:12⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2380 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:12⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2416 --field-trial-handle=1248,i,13226340568530238321,1140095356444582896,131072 /prefetch:12⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1928
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2124
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1801⤵PID:2460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD5132badcbd9fe52cb5f3b49a2875848c4
SHA1461739f4c99c5524935b75ea6e9586b17421b490
SHA2561988d609ec50f4b3434b590f85129e6a2d5cf3947177ff29f0bf2bd911843cba
SHA5126bea7ccc9bb6ab02a485f59648d8ca381273fee49bfa528dec4020aba4c99ead5896d67c1b4300a3ab01c63060fc5a1a22d4735512439f0f492a00fce81295eb
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
363B
MD574100f8427ba35d24cdfc3291153bca8
SHA13d308234c1a9cd80b15d0f3f710e3fd49680f5f3
SHA25671efa4764950f8aa2107a10678694091411e6d2988b7e836403ec01205d76d85
SHA512221cb1b18ba55135c4497f3be8d7f37c44b8a4a59dd86e4a01858ecab1ca4d3deb97e829775c643ec36e5221b90a766a71d0bdde22afaa9940585a95cbb6abee
-
Filesize
4KB
MD512e7346cf1919b33a6b20543ab851116
SHA1988d1ff03a64d3fdb6ab433cab579f2904bd1e59
SHA2560eb8a34c5164493b35c5a183ae7a1a652027350cbfa7047256d86809e5adaaa6
SHA5129987ae1319bdad0ec5bb6c66eb157e98f940198d5163265cc9f097d68cc5a53644367886bf597a71ae2a2095cdfd2fef892dcf5da10098164f5d4426cebd9717
-
Filesize
5KB
MD5e397857245dd83952bf2f616234ae5d0
SHA127e55031a4a4fbe4deaae370fcdca3cb28971bc7
SHA2567d977a0699e43b5c7995efa48d77c30ec2d4b70075f8c1df0b18c56c1041200b
SHA5129627f7d283b062943e7db4aa93eb90932214325a2e9ab194e2c122ad34cf7e5a73544d2915b3af106c82d44120107ab86f8aca7e592053416ed7c2fcd4ef1c59
-
Filesize
5KB
MD508d0cba3bd325d3c7b4d4a71cfff2bb7
SHA129e418eee3c7d63fc084d9e1386d2dd4aa61fada
SHA256c8f97ec9f6027857e375dca247ebe422904ab1cf056931536bd6936e00279ae6
SHA5121b02851bcb1c813f08fd0d630591534d1a929e3da3abe771896db6a91014a0a9ae404eeb93df922973d2933d061686da7795f81ee297c68eb4b621244a0030d9
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
312KB
MD5058f05e6d4fdca8607c926873148bf80
SHA110b0d490f8a45758dcfaf5236b8813dec42cf2d0
SHA256894f11b10435fe5caeb7eaa412c55f30d69a6529b069e60b7fd14e3145408afb
SHA512a11ba3f34808689e064057bdc3c16b9515a424d30c9b932a97ee813a96f64550a7423606c4d155ae85103e4d859ed157eea5d3dcce6725d874947e2e28c23a55