hxxps://cdn[.]discordapp[.]com/attachments/1368469828528246874/1542908797507469453/FL_Studio_26_1_5_5618_Windows_KeyGen___AudioWarez[.]7z?ex=6a92f14b&is=6a919fcb&hm=9e1d60c5268ac55332d3788e0358e9ebbdedfad51999a9a3dc28a98deb316235&

General

Target
https://cdn.discordapp.com/attachments/1368469828528246874/1542908797507469453/FL_Studio_26_1_5_5618_Windows_KeyGen___AudioWarez.7z?ex=6a92f14b&is=6a919fcb&hm=9e1d60c5268ac55332d3788e0358e9ebbdedfad51999a9a3dc28a98deb316235&
Sample261102-mcnlxagy6z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
8	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4672	3416	chrome.exe	82
PID 3416 wrote to memory of 8	3416	chrome.exe	83
PID 3416 wrote to memory of 1196	3416	chrome.exe	84
PID 3416 wrote to memory of 1196	3416	chrome.exe	84
PID 3416 wrote to memory of 756	3416	chrome.exe	86
PID 3416 wrote to memory of 756	3416	chrome.exe	86
PID 3416 wrote to memory of 1592	3416	chrome.exe	87
PID 3416 wrote to memory of 5052	3416	chrome.exe	88
PID 3416 wrote to memory of 1592	3416	chrome.exe	87
PID 3416 wrote to memory of 5052	3416	chrome.exe	88
PID 3416 wrote to memory of 4856	3416	chrome.exe	89
PID 3416 wrote to memory of 4856	3416	chrome.exe	89
PID 3416 wrote to memory of 2492	3416	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1368469828528246874/1542908797507469453/FL_Studio_26_1_5_5618_Windows_KeyGen___AudioWarez.7z?ex=6a92f14b&is=6a919fcb&hm=9e1d60c5268ac55332d3788e0358e9ebbdedfad51999a9a3dc28a98deb316235&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff88f8cc728,0x7ff88f8cc734,0x7ff88f8cc740
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10128709440638383522,9128342136674884639,524288 --field-trial-handle=2212,i,1708798592504060942,16167611682443934209,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1880 /prefetch:3
  2⤵
  - System Time Discovery
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,6049157242702129258,1098187190318811423,262144 --field-trial-handle=2212,i,1708798592504060942,16167611682443934209,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,15455904304579379458,8328791285497086905,524288 --field-trial-handle=2212,i,1708798592504060942,16167611682443934209,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,9158366881462621081,12387839886419760189,2097152 --field-trial-handle=2212,i,1708798592504060942,16167611682443934209,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,4113346296505467619,15824887362681378784,2097152 --field-trial-handle=2212,i,1708798592504060942,16167611682443934209,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4236,i,1663606844063307161,3595393384542764402,2097152 --field-trial-handle=2212,i,1708798592504060942,16167611682443934209,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,795303483323571998,12126766905003508323,524288 --field-trial-handle=2212,i,1708798592504060942,16167611682443934209,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

2

T1082

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43fd4d59-1c01-4e9e-8bc3-fa220b64506b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\43fd4d59-1c01-4e9e-8bc3-fa220b64506b.tmp
Size 132KB
SHA256 25ccc4dd5dc52f8c23d11b102bf3e463c2c0a3a6a8f45ba3679cc94760803d17
MD5 37f6f7a4039aef434cae5735183c7519
SHA1 188b453205bf6914d53f4a9e613b68b6f644640e
SHA512 2b695a27cd01e1c19749b40cad309a4d16f3873e19b2a99d0e03c8e571cbcbc6514f6c4ec0ce144dc7be656fbf1563880161e0fc8b862b6f7fc56ceb8e3e6b6a
SSDEEP 3072:8oRIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:8o9Ptbmf1K49XLWbEPi4NTKlLzh
TLSH
T1E9D312217D05BCB4A9EEDB21A1901A16EAB8D94F953D3BE65CDE3F4806E3699C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fb03040-6bc6-478f-80bd-a6b271bda653.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5fb03040-6bc6-478f-80bd-a6b271bda653.tmp
Size 131KB
SHA256 135ad53363181ae6cc51d36f0411fe77425d35998008e96aa44be423a10ce3f3
MD5 3bba7f8c5e9568ad51447f0237ce3203
SHA1 0c632613b3638c59b5514c716bbd6bbd6702041d
SHA512 092f87fa0b0b42b831a716f0496b8f8d495f57c6920cb91ef1e4e0bfcf79cc8d1275e03196b3c34d558ffc2ec8721d56412d2e0f3ca0d976ad8aebf9a7aa751d
SSDEEP 3072:lIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:BPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T185D312217D01BCB8A9AEDB21B1901A15E6B8D94BD53D7BE61CDE3F4805E36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4545fafa-74f5-4b60-8048-7b55e43f22a8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4545fafa-74f5-4b60-8048-7b55e43f22a8.tmp
Size 414B
SHA256 1c66c09066ce229c9a56d3d55099e14c0be568d582e777f7e2e8501955ec74dd
MD5 e9458f459c84bc2c62aee363b1b34b50
SHA1 1cf71188905a203cbbcac39897d44af71eda624c
SHA512 f3f119954cb0a53139ed8ba781c9f1e78856b40c867f23374f84294c4057c38888b3e81f4c0ff3508e2713a732b5be1581810821b4b97b7f0b016bd0cebc2a09
TLSH
T147E02BEECD22EC3715F9075860544B4BE70113172A50990F363CA20CCFB1A3B41C196C
MD5 SHA1 SHA512 TLSH

Submit Download

6d963d3d-a14c-4e08-9dbf-5d5c06dc4e55.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6d963d3d-a14c-4e08-9dbf-5d5c06dc4e55.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

996ab8a0-e998-48d8-921c-fce3c079a6a4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\996ab8a0-e998-48d8-921c-fce3c079a6a4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c9b09ab9-c1e6-4f98-a7e8-17096a5e2a60.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c9b09ab9-c1e6-4f98-a7e8-17096a5e2a60.tmp
Size 17KB
SHA256 bc874b5dfd433743339ca27fbc016d54b007fab3e56af9f017a931025cb0f537
MD5 8d3394a14b12f06ecbe650f06b4881fa
SHA1 d4c8ccc659c5c983f73adedfc2f5491607ac031e
SHA512 5052397393a9e12e611402bc4ac104433e8a02a13f8c7f9236e7f653a48cb0a7aaac61660c212ab456241d0ca72e689c0cbd6c0186b51f3570b8c09ec3b374b4
SSDEEP 384:K0juV7KxkXqKf/pUZNCgVLH2HfgslRU7pLuLceScdXODu1+ErU3pfHGeXTuxL:KYuV7KxkXqKf/pUZNCgVLH2HfgsDU7p0
TLSH
T15972E967AC4CAA3B0FD4CACCD8277F4FEDB5025A65D9886443FA982503D5ACB11061E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fff39baf-7f0c-49bc-b317-72d36234eaf6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fff39baf-7f0c-49bc-b317-72d36234eaf6.tmp
Size 12KB
SHA256 b08dae71c7f59d055af29fac9515097a8d60b21dc8babc74daa14ff1e9d987c0
MD5 62a8e4567aac80d49662fbcdf41e85ea
SHA1 47e759dda055dd583a977c9807d41b76e1060ad3
SHA512 8347773c0d15a2af37ae735853b085dd0613ab6d079758e441a0f5adf1e272423b59570efef1ea51a0a82927fe4529f0b80fe763b64ffda5883e33628cdeff3c
SSDEEP 192:VRrrng5Thhv7MpAPRp2zo9tHsb+WNnJvXB2g2OIQ1UVyIsnAUge:VRrrIxwUXZvwlXZ2HLe
TLSH
T14E42C52DAD50793B9CDBD629F9A67B97D7F5203130942E84E6FC882C25E75CC2223407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads