c14ac291f1e47b79c3f967ff017945e59a50f90a3b1273cd2726504ec6b4e758

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

TotalRecorder Pro v5.2 正式注册版/TotalRecorder.exe
Size

2.3MB
MD5

7b2a0e2e2c359f6d185ac31137ddc340
SHA1

d85b76f8912078391d5cc0bc5f7dff6f2e254261
SHA256

d6225cd807b39da1d90d0cf3e45b851f4c924d1d06ad8e235d6143b7d113d867
SHA512

6a597fdf44f455f4690694a1ee4f3139697ce4aba154543157663a426a2100f51eac4d4a280b08b51c7c93aa73eea9312177817f3cb1a2060e7432294b5c0a82
SSDEEP

24576:N8a8QEpnWRFvypMveSSBA/x2CZvoF3NwcO5Srksq8T2/5Ojq3phicKkhZyWiLq84:u/WKYe6xANbkFbphicP3Hl+tw7o

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TotalRecorder.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TotalRecorder.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TotalRecorder.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TotalRecorder.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3936	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1676	TotalRecorder.exe
1676	TotalRecorder.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1784	1676	TotalRecorder.exe	89
PID 1676 wrote to memory of 1784	1676	TotalRecorder.exe	89

C:\Users\Admin\AppData\Local\Temp\TotalRecorder Pro v5.2 正式注册版\TotalRecorder.exe
"C:\Users\Admin\AppData\Local\Temp\TotalRecorder Pro v5.2 正式注册版\TotalRecorder.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\pcaui.exe
  "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {ca5f1381-6973-4fca-bec5-224b33843200} -a "Total Recorder" -v "High Criteria inc." -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 1 -f 0 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\TotalRecorder Pro v5.2 正式注册版\TotalRecorder.exe"
  2⤵
  PID:1784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1016,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads