hxxps://mega[.]nz/file/jE10VaJZ#JUVA25eyV3D1NBdhFWfCxxIXcHOp2In2xQPftdkpMjU

General

Target

https://mega.nz/file/jE10VaJZ#JUVA25eyV3D1NBdhFWfCxxIXcHOp2In2xQPftdkpMjU

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

swz.exexscT83UADnhAUXwhszShkELDsL5vmSD8Znd.exe

pid process

4448 swz.exe
4552 xscT83UADnhAUXwhszShkELDsL5vmSD8Znd.exe

pid	process
4448	swz.exe
4552	xscT83UADnhAUXwhszShkELDsL5vmSD8Znd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\swz.exe	upx
C:\Users\Admin\Desktop\swz.exe	upx
behavioral1/memory/4448-128-0x0000000140000000-0x0000000140807000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

swz.exe

pid process

4448 swz.exe
Drops file in Program Files directory 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\swz.exe chrome.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4448	swz.exe

description	ioc	process
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\swz.exe	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 23 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4592	taskkill.exe
1584	taskkill.exe
2404	taskkill.exe
4952	taskkill.exe
4188	taskkill.exe
3644	taskkill.exe
2972	taskkill.exe
680	taskkill.exe
4040	taskkill.exe
4312	taskkill.exe
3492	taskkill.exe
2268	taskkill.exe
4584	taskkill.exe
2096	taskkill.exe
4320	taskkill.exe
3088	taskkill.exe
2956	taskkill.exe
4076	taskkill.exe
2704	taskkill.exe
4408	taskkill.exe
1476	taskkill.exe
4900	taskkill.exe
596	taskkill.exe

Modifies registry class 4 IoCs

Processes:

control.execontrol.exechrome.execontrol.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	control.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	control.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	control.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeswz.exe

pid	process
4180	chrome.exe
4180	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
2188	chrome.exe
2188	chrome.exe
4880	chrome.exe
4880	chrome.exe
2736	chrome.exe
2736	chrome.exe
3500	chrome.exe
3500	chrome.exe
2180	chrome.exe
2180	chrome.exe
2084	chrome.exe
2084	chrome.exe
4904	chrome.exe
4904	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
3952	chrome.exe
3952	chrome.exe
4448	swz.exe
4448	swz.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid process

3676 chrome.exe
3676 chrome.exe
3676 chrome.exe
3676 chrome.exe
3676 chrome.exe
3676 chrome.exe
3676 chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

control.execontrol.exerundll32.execontrol.exerundll32.exe7zFM.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeShutdownPrivilege	1508	control.exe
Token: SeCreatePagefilePrivilege	1508	control.exe
Token: SeShutdownPrivilege	1268	control.exe
Token: SeCreatePagefilePrivilege	1268	control.exe
Token: SeSystemtimePrivilege	2008	rundll32.exe
Token: SeSystemtimePrivilege	2008	rundll32.exe
Token: SeSystemtimePrivilege	2008	rundll32.exe
Token: SeSystemtimePrivilege	2008	rundll32.exe
Token: SeShutdownPrivilege	2056	control.exe
Token: SeCreatePagefilePrivilege	2056	control.exe
Token: SeSystemtimePrivilege	4476	rundll32.exe
Token: SeSystemtimePrivilege	4476	rundll32.exe
Token: SeSystemtimePrivilege	4476	rundll32.exe
Token: SeSystemtimePrivilege	4476	rundll32.exe
Token: SeRestorePrivilege	344	7zFM.exe
Token: 35	344	7zFM.exe
Token: SeSecurityPrivilege	344	7zFM.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	2972	taskkill.exe
Token: SeDebugPrivilege	680	taskkill.exe
Token: SeDebugPrivilege	4076	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	3492	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	1476	taskkill.exe
Token: SeDebugPrivilege	1584	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	4188	taskkill.exe
Token: SeDebugPrivilege	4584	taskkill.exe
Token: SeDebugPrivilege	4040	taskkill.exe
Token: SeDebugPrivilege	3644	taskkill.exe
Token: SeDebugPrivilege	4312	taskkill.exe
Token: SeDebugPrivilege	2096	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	596	taskkill.exe
Token: SeDebugPrivilege	3088	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exe

pid	process
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3676 wrote to memory of 3576	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3576	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4172	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4180	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4180	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 4420	3676	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://mega.nz/file/jE10VaJZ#JUVA25eyV3D1NBdhFWfCxxIXcHOp2In2xQPftdkpMjU
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb358f4f50,0x7ffb358f4f60,0x7ffb358f4f70
2⤵
PID:3576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1920 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1544 /prefetch:2
2⤵
PID:4172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 /prefetch:8
2⤵
PID:4420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:1
2⤵
PID:4452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
2⤵
PID:700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4088 /prefetch:8
2⤵
PID:376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
2⤵
PID:492

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.DateAndTime
2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\timedate.cpl
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3100 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4820 /prefetch:8
2⤵
PID:2268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4840 /prefetch:8
2⤵
PID:4040

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.DateAndTime
2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\timedate.cpl
3⤵
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4212 /prefetch:8
2⤵
PID:4584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4852 /prefetch:8
2⤵
PID:4588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:8
2⤵
PID:4268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4848 /prefetch:8
2⤵
PID:2856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:8
2⤵
PID:5088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 /prefetch:8
2⤵
PID:5060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
2⤵
PID:4796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2512 /prefetch:1
2⤵
PID:320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
2⤵
PID:2508

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.DateAndTime
2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\timedate.cpl
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:8
2⤵
PID:4284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
2⤵
PID:5048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3024 /prefetch:8
2⤵
PID:3628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2996 /prefetch:8
2⤵
PID:3868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5256 /prefetch:8
2⤵
PID:1532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5412 /prefetch:8
2⤵
- Drops file in Program Files directory
PID:2404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5796 /prefetch:8
2⤵
PID:1332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 /prefetch:8
2⤵
PID:4584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5520 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,15587866119258827796,8547505705549826150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1584

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2292

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4500

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Loader.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Users\Admin\Desktop\swz.exe
"C:\Users\Admin\Desktop\swz.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:3700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:1992

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:4796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:4232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:1220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:2964

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:2132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:1996

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:2216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:2076

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:3972

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:3400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:3628

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:5036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:3864

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:3152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:1396

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:1920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:1764

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:2676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:2240

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:2304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:1012

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:2432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:2004

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:2332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:4916

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:4488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:3936

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:3756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:5064

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:2944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:3448

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:2872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:3184

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:4300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:348

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:4364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:1688

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:1352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:744

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:812

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:2308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /T /IM setuperr.exe
2⤵
PID:1768

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:520

C:\Users\Admin\AppData\Local\Temp\xscT83UADnhAUXwhszShkELDsL5vmSD8Znd.exe
"C:\Users\Admin\AppData\Local\Temp\xscT83UADnhAUXwhszShkELDsL5vmSD8Znd.exe"
2⤵
- Executes dropped EXE
PID:4552

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM setuperr.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xscT83UADnhAUXwhszShkELDsL5vmSD8Znd.exe
MD5
cd9b53c2e589361c01423639db787dd1

SHA1
91b4614e1b13ba2c697b0bb9dcc0e7975eee6283

SHA256
ae63744f4e9f1e2b0e29a4073e1106337ee15dead315a117db3840717ed102bd

SHA512
ddf8e0958229f4afc9d713e27f47b188d18405e5cf385144729a3cc607f2e86e048f908007818577c8d81eb7b2dfb84eeb92e2f9c7c88d1ddd9fddc8fd848aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\xscT83UADnhAUXwhszShkELDsL5vmSD8Znd.exe
MD5
cd9b53c2e589361c01423639db787dd1

SHA1
91b4614e1b13ba2c697b0bb9dcc0e7975eee6283

SHA256
ae63744f4e9f1e2b0e29a4073e1106337ee15dead315a117db3840717ed102bd

SHA512
ddf8e0958229f4afc9d713e27f47b188d18405e5cf385144729a3cc607f2e86e048f908007818577c8d81eb7b2dfb84eeb92e2f9c7c88d1ddd9fddc8fd848aac

Download Submit
C:\Users\Admin\Desktop\swz.exe
MD5
86b0a59ac36bfc73dbed070457b51aa4

SHA1
1ae92612a11c3f2e3fa4faeea62e7e6de91fa551

SHA256
d0508888c9b29031e9d5860dd8936ba07d4e7b482ee1f3a19a3dd4b6310ea484

SHA512
40af67b66f9d70c2afcae96e57af1c14cdd1eff0813214402462d532b296eb245fc541078b66a5c21182ced1cdd2fb5f269e27ca3bc8463b3879fb3e13325fb6

Download Submit
C:\Users\Admin\Desktop\swz.exe
MD5
86b0a59ac36bfc73dbed070457b51aa4

SHA1
1ae92612a11c3f2e3fa4faeea62e7e6de91fa551

SHA256
d0508888c9b29031e9d5860dd8936ba07d4e7b482ee1f3a19a3dd4b6310ea484

SHA512
40af67b66f9d70c2afcae96e57af1c14cdd1eff0813214402462d532b296eb245fc541078b66a5c21182ced1cdd2fb5f269e27ca3bc8463b3879fb3e13325fb6

Download Submit
C:\Users\Admin\Downloads\Loader.rar
MD5
8c7ecef5b23bf1b1f19a4ec480c1ffa9

SHA1
a1ae8c12b6b3e9d5d2e65747ab0c3d3f372104d5

SHA256
0da48a27672c142fdc0409ab8ff7eb33b2432216a8d7ba474a91cb0d91e26bef

SHA512
31c3469e7fcfbf7d10604a7e9de84dccb17c1cf6f7fe18e5aab44099742add28aa872ecdc12665eec3ea2df455df5f4ba81475eb5e20f52497325060c18c8c62

Download Submit
\??\pipe\crashpad_3676_CPDQPHXVFJTKVCYM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/348-185-0x0000000000000000-mapping.dmp

Download
memory/680-142-0x0000000000000000-mapping.dmp

Download
memory/1012-164-0x0000000000000000-mapping.dmp

Download
memory/1220-137-0x0000000000000000-mapping.dmp

Download
memory/1268-121-0x0000000000000000-mapping.dmp

Download
memory/1396-155-0x0000000000000000-mapping.dmp

Download
memory/1476-156-0x0000000000000000-mapping.dmp

Download
memory/1508-119-0x0000000000000000-mapping.dmp

Download
memory/1584-159-0x0000000000000000-mapping.dmp

Download
memory/1764-158-0x0000000000000000-mapping.dmp

Download
memory/1920-157-0x0000000000000000-mapping.dmp

Download
memory/1976-131-0x0000000000000000-mapping.dmp

Download
memory/1992-132-0x0000000000000000-mapping.dmp

Download
memory/1996-141-0x0000000000000000-mapping.dmp

Download
memory/2004-167-0x0000000000000000-mapping.dmp

Download
memory/2008-120-0x0000000000000000-mapping.dmp

Download
memory/2056-123-0x0000000000000000-mapping.dmp

Download
memory/2076-144-0x0000000000000000-mapping.dmp

Download
memory/2132-140-0x0000000000000000-mapping.dmp

Download
memory/2216-143-0x0000000000000000-mapping.dmp

Download
memory/2240-161-0x0000000000000000-mapping.dmp

Download
memory/2268-162-0x0000000000000000-mapping.dmp

Download
memory/2304-163-0x0000000000000000-mapping.dmp

Download
memory/2332-169-0x0000000000000000-mapping.dmp

Download
memory/2404-165-0x0000000000000000-mapping.dmp

Download
memory/2432-166-0x0000000000000000-mapping.dmp

Download
memory/2676-160-0x0000000000000000-mapping.dmp

Download
memory/2704-147-0x0000000000000000-mapping.dmp

Download
memory/2872-181-0x0000000000000000-mapping.dmp

Download
memory/2944-178-0x0000000000000000-mapping.dmp

Download
memory/2956-136-0x0000000000000000-mapping.dmp

Download
memory/2964-138-0x0000000000000000-mapping.dmp

Download
memory/2972-139-0x0000000000000000-mapping.dmp

Download
memory/3152-154-0x0000000000000000-mapping.dmp

Download
memory/3184-182-0x0000000000000000-mapping.dmp

Download
memory/3400-148-0x0000000000000000-mapping.dmp

Download
memory/3448-179-0x0000000000000000-mapping.dmp

Download
memory/3492-150-0x0000000000000000-mapping.dmp

Download
memory/3628-149-0x0000000000000000-mapping.dmp

Download
memory/3644-183-0x0000000000000000-mapping.dmp

Download
memory/3700-130-0x0000000000000000-mapping.dmp

Download
memory/3756-175-0x0000000000000000-mapping.dmp

Download
memory/3864-152-0x0000000000000000-mapping.dmp

Download
memory/3936-173-0x0000000000000000-mapping.dmp

Download
memory/3972-146-0x0000000000000000-mapping.dmp

Download
memory/4040-180-0x0000000000000000-mapping.dmp

Download
memory/4076-145-0x0000000000000000-mapping.dmp

Download
memory/4188-174-0x0000000000000000-mapping.dmp

Download
memory/4232-135-0x0000000000000000-mapping.dmp

Download
memory/4300-184-0x0000000000000000-mapping.dmp

Download
memory/4312-186-0x0000000000000000-mapping.dmp

Download
memory/4364-187-0x0000000000000000-mapping.dmp

Download
memory/4408-153-0x0000000000000000-mapping.dmp

Download
memory/4448-128-0x0000000140000000-0x0000000140807000-memory.dmp

Filesize
8.0MB

Download
memory/4448-129-0x00007FFB41EE0000-0x00007FFB41EE2000-memory.dmp

Filesize
8KB

Download
memory/4476-124-0x0000000000000000-mapping.dmp

Download
memory/4488-172-0x0000000000000000-mapping.dmp

Download
memory/4584-177-0x0000000000000000-mapping.dmp

Download
memory/4592-133-0x0000000000000000-mapping.dmp

Download
memory/4796-134-0x0000000000000000-mapping.dmp

Download
memory/4888-122-0x0000000000000000-mapping.dmp

Download
memory/4900-168-0x0000000000000000-mapping.dmp

Download
memory/4916-170-0x0000000000000000-mapping.dmp

Download
memory/4952-171-0x0000000000000000-mapping.dmp

Download
memory/5036-151-0x0000000000000000-mapping.dmp

Download
memory/5064-176-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads