njrat | hxxps://gofile[.]io/d/Dud86E

Resubmissions

11-01-2022 20:22

220111-y5q4aahba6 8

11-01-2022 16:43

220111-t8mstagegj 1

10-12-2021 09:11

211210-k5llxagaa4 10

Analysis

max time kernel
191s
max time network
186s
platform
windows10_x64
resource
win10-en-20211208
submitted
10-12-2021 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/Dud86E

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 7 IoCs

Processes:

Dork Searcher Setup v1091.exeDork Searcher Setup v1091.exeChrome.exeSystem.exeDork Generator v1.0.exeDork Generator v1.0.exeChrome.exe

pid	process
4012	Dork Searcher Setup v1091.exe
4288	Dork Searcher Setup v1091.exe
4912	Chrome.exe
4604	System.exe
3900	Dork Generator v1.0.exe
380	Dork Generator v1.0.exe
384	Chrome.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops startup file 6 IoCs

Processes:

System.exexcopy.exexcopy.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fe3aa34eb4082a28a73159cf657a9f0d.exe	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fe3aa34eb4082a28a73159cf657a9f0d.exe	System.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe	xcopy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe	xcopy.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe	xcopy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe	xcopy.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

System.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\fe3aa34eb4082a28a73159cf657a9f0d = "\"C:\\Users\\Admin\\AppData\\Roaming\\System.exe\" .."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fe3aa34eb4082a28a73159cf657a9f0d = "\"C:\\Users\\Admin\\AppData\\Roaming\\System.exe\" .."	System.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

7zG.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Combiner v1.2 by Volevanya\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Tools V.5.0\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Tools V.5.0\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Combiner v1.2 by Volevanya\Virus Total\desktop.ini	7zG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 8 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Searcher Setup v1091\Dork Searcher Setup v1091.exe	nsis_installer_1
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Searcher Setup v1091\Dork Searcher Setup v1091.exe	nsis_installer_2
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Searcher Setup v1091\Dork Searcher Setup v1091.exe	nsis_installer_1
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Searcher Setup v1091\Dork Searcher Setup v1091.exe	nsis_installer_2
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Generator v1.0 by kidux\Dork Generator v1.0.exe	nsis_installer_1
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Generator v1.0 by kidux\Dork Generator v1.0.exe	nsis_installer_2
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Generator v1.0 by kidux\Dork Generator v1.0.exe	nsis_installer_1
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Generator v1.0 by kidux\Dork Generator v1.0.exe	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
3960	chrome.exe
3960	chrome.exe
3592	chrome.exe
3592	chrome.exe
1032	chrome.exe
1032	chrome.exe
1700	chrome.exe
1700	chrome.exe
3692	chrome.exe
3692	chrome.exe
3836	chrome.exe
3836	chrome.exe
3360	chrome.exe
3360	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

chrome.exe

pid	process
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

7zG.exeChrome.exeSystem.exeChrome.exe

description	pid	process
Token: SeRestorePrivilege	3604	7zG.exe
Token: 35	3604	7zG.exe
Token: SeSecurityPrivilege	3604	7zG.exe
Token: SeSecurityPrivilege	3604	7zG.exe
Token: SeDebugPrivilege	4912	Chrome.exe
Token: SeDebugPrivilege	4604	System.exe
Token: SeDebugPrivilege	384	Chrome.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe
Token: 33	4604	System.exe
Token: SeIncBasePriorityPrivilege	4604	System.exe

Suspicious use of FindShellTrayWindow 55 IoCs

Processes:

chrome.exe7zG.exe

pid	process
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3604	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

Dork Searcher Setup v1091.exeDork Searcher Setup v1091.exeDork Generator v1.0.exeDork Generator v1.0.exe

pid process

4012 Dork Searcher Setup v1091.exe
4288 Dork Searcher Setup v1091.exe
3900 Dork Generator v1.0.exe
380 Dork Generator v1.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3592 wrote to memory of 3500	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 3500	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4092	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 3960	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 3960	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe
PID 3592 wrote to memory of 4376	3592	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://gofile.io/d/Dud86E
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffea4874f50,0x7ffea4874f60,0x7ffea4874f70
2⤵
PID:3500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1704 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1548 /prefetch:2
2⤵
PID:4092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:8
2⤵
PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2920 /prefetch:1
2⤵
PID:4352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
2⤵
PID:4480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4192 /prefetch:8
2⤵
PID:628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4372 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
2⤵
PID:1772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
2⤵
PID:2372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
2⤵
PID:1784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
2⤵
PID:3856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
2⤵
PID:1208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
2⤵
PID:1316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
2⤵
PID:2016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
2⤵
PID:2336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
2⤵
PID:4624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
2⤵
PID:1932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
2⤵
PID:1956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
2⤵
PID:5092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7176 /prefetch:8
2⤵
PID:4540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7056 /prefetch:8
2⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7044 /prefetch:8
2⤵
PID:1460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6096 /prefetch:8
2⤵
PID:1552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5768 /prefetch:8
2⤵
PID:2012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6932 /prefetch:8
2⤵
PID:2144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3092 /prefetch:8
2⤵
PID:2396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6452 /prefetch:8
2⤵
PID:8

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5832 /prefetch:8
2⤵
PID:1984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
2⤵
PID:4072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
2⤵
PID:876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7224 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6952 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,1189229970629086140,17277267123273206235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3164 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3968

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\" -spe -an -ai#7zMap5740:112:7zEvent15656
1⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3604

C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Searcher Setup v1091\Dork Searcher Setup v1091.exe
"C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Searcher Setup v1091\Dork Searcher Setup v1091.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4012

C:\Users\Admin\AppData\Roaming\Dork Searcher Setup v1091.exe
"C:\Users\Admin\AppData\Roaming\Dork Searcher Setup v1091.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Users\Admin\AppData\Roaming\Chrome.exe
"C:\Users\Admin\AppData\Roaming\Chrome.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\SYSTEM32\xcopy.exe
"xcopy.exe" "C:\Users\Admin\AppData\Roaming\Chrome.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe*"
3⤵
- Drops startup file
PID:5088

C:\Users\Admin\AppData\Roaming\System.exe
"C:\Users\Admin\AppData\Roaming\System.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\SYSTEM32\xcopy.exe
"xcopy.exe" "C:\Users\Admin\AppData\Roaming\System.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe*"
4⤵
- Drops startup file
PID:1876

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\System.exe" "System.exe" ENABLE
4⤵
PID:4568

C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Generator v1.0 by kidux\Dork Generator v1.0.exe
"C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Generator v1.0 by kidux\Dork Generator v1.0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3900

C:\Users\Admin\AppData\Roaming\Dork Generator v1.0.exe
"C:\Users\Admin\AppData\Roaming\Dork Generator v1.0.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:380

C:\Users\Admin\AppData\Roaming\Chrome.exe
"C:\Users\Admin\AppData\Roaming\Chrome.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\Chrome.exe.log
MD5
b5615202a61f08deb39fb6146885c86a

SHA1
3a19972cb2df4cc349d0d71f7c74cbbcc25f00ba

SHA256
660c15a3c85795f12438fb100c1b5f971c02bf30d2af95486d1726f39f0f3955

SHA512
27e3d294069db488d3d5b359a3b38467f0ed121791492038991a0a62b532cd751e307b01552eabb99acf64f84cc62f49e7405d992a6b9192008213f723171879

Download Submit
C:\Users\Admin\AppData\Roaming\Chrome.exe
MD5
37ef7796d3f9026c1cedbb218aab93a5

SHA1
498a2fa3f69f7a365859709cfd1e6d3c0558a809

SHA256
eb4349fc7cfec587cb8317c40614acdb02bf6ea6233d3f16803e181921302077

SHA512
f9bc1e8efe680928ee5d981355bec339aca3f017bd7295bf12fdfae050f7b92943af6441308fb259ccbc1e5c478ad6089963c5eed76049360801a7b4bbd64729

Download Submit
C:\Users\Admin\AppData\Roaming\Chrome.exe
MD5
37ef7796d3f9026c1cedbb218aab93a5

SHA1
498a2fa3f69f7a365859709cfd1e6d3c0558a809

SHA256
eb4349fc7cfec587cb8317c40614acdb02bf6ea6233d3f16803e181921302077

SHA512
f9bc1e8efe680928ee5d981355bec339aca3f017bd7295bf12fdfae050f7b92943af6441308fb259ccbc1e5c478ad6089963c5eed76049360801a7b4bbd64729

Download Submit
C:\Users\Admin\AppData\Roaming\Chrome.exe
MD5
37ef7796d3f9026c1cedbb218aab93a5

SHA1
498a2fa3f69f7a365859709cfd1e6d3c0558a809

SHA256
eb4349fc7cfec587cb8317c40614acdb02bf6ea6233d3f16803e181921302077

SHA512
f9bc1e8efe680928ee5d981355bec339aca3f017bd7295bf12fdfae050f7b92943af6441308fb259ccbc1e5c478ad6089963c5eed76049360801a7b4bbd64729

Download Submit
C:\Users\Admin\AppData\Roaming\Chrome.exe
MD5
37ef7796d3f9026c1cedbb218aab93a5

SHA1
498a2fa3f69f7a365859709cfd1e6d3c0558a809

SHA256
eb4349fc7cfec587cb8317c40614acdb02bf6ea6233d3f16803e181921302077

SHA512
f9bc1e8efe680928ee5d981355bec339aca3f017bd7295bf12fdfae050f7b92943af6441308fb259ccbc1e5c478ad6089963c5eed76049360801a7b4bbd64729

Download Submit
C:\Users\Admin\AppData\Roaming\Dork Generator v1.0.exe
MD5
ced5301345571b7dca14d23f01c2b512

SHA1
41c7d3662ff468d149a56ce585981703f28e7df0

SHA256
fb59b2772c663587649450d9496e9cedf1cecce035d5e3f8fa063fe7e417a5a0

SHA512
659d3706c6fad10c89d38369b4af94d7cd4ad94d7fda22420160f10be0dfd33b4524a18a42ef1a77abe8b58b5e9b72d061162b3fefbef77376af4e4ab66e41b1

Download Submit
C:\Users\Admin\AppData\Roaming\Dork Generator v1.0.exe
MD5
ced5301345571b7dca14d23f01c2b512

SHA1
41c7d3662ff468d149a56ce585981703f28e7df0

SHA256
fb59b2772c663587649450d9496e9cedf1cecce035d5e3f8fa063fe7e417a5a0

SHA512
659d3706c6fad10c89d38369b4af94d7cd4ad94d7fda22420160f10be0dfd33b4524a18a42ef1a77abe8b58b5e9b72d061162b3fefbef77376af4e4ab66e41b1

Download Submit
C:\Users\Admin\AppData\Roaming\Dork Searcher Setup v1091.exe
MD5
0324a8181ad775dc6e99a876ffa5b96e

SHA1
a86ac5f9bd27be4115d3b05ec25292ff7b13d4ea

SHA256
c687d3542e90ec5054f0abc99538a6e714fc2821919753806fb3438350f44c11

SHA512
9762084c856170348f356d67f0178b23fdcaded795345e8c3469e64e1f1cfc1fa8ff30c96022154efba19df5f3375b69d8337be4cd10b4270e7e0581fb649bc4

Download Submit
C:\Users\Admin\AppData\Roaming\Dork Searcher Setup v1091.exe
MD5
0324a8181ad775dc6e99a876ffa5b96e

SHA1
a86ac5f9bd27be4115d3b05ec25292ff7b13d4ea

SHA256
c687d3542e90ec5054f0abc99538a6e714fc2821919753806fb3438350f44c11

SHA512
9762084c856170348f356d67f0178b23fdcaded795345e8c3469e64e1f1cfc1fa8ff30c96022154efba19df5f3375b69d8337be4cd10b4270e7e0581fb649bc4

Download Submit
C:\Users\Admin\AppData\Roaming\System.exe
MD5
37ef7796d3f9026c1cedbb218aab93a5

SHA1
498a2fa3f69f7a365859709cfd1e6d3c0558a809

SHA256
eb4349fc7cfec587cb8317c40614acdb02bf6ea6233d3f16803e181921302077

SHA512
f9bc1e8efe680928ee5d981355bec339aca3f017bd7295bf12fdfae050f7b92943af6441308fb259ccbc1e5c478ad6089963c5eed76049360801a7b4bbd64729

Download Submit
C:\Users\Admin\AppData\Roaming\System.exe
MD5
37ef7796d3f9026c1cedbb218aab93a5

SHA1
498a2fa3f69f7a365859709cfd1e6d3c0558a809

SHA256
eb4349fc7cfec587cb8317c40614acdb02bf6ea6233d3f16803e181921302077

SHA512
f9bc1e8efe680928ee5d981355bec339aca3f017bd7295bf12fdfae050f7b92943af6441308fb259ccbc1e5c478ad6089963c5eed76049360801a7b4bbd64729

Download Submit
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021.rar
MD5
0a99b6a5a8eb108b26db18f86dc0206d

SHA1
dd10285534f61a882e328f999ae295b8db02207a

SHA256
4f7a1df79b7bdfe497c662ada70b71cff64caf6d82d8a4f15b12a1a99fdac105

SHA512
43d80f4650999676c04958e27ec0081400c2d2af208a144652d582fdc7b5d91420af3e6e6ef0dee981ff8d88ff01035c1f3111cee8b57645f50d35a646dcdc99

Download Submit
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Generator v1.0 by kidux\Dork Generator v1.0.exe
MD5
1702dc6ab7909e5ec759819d31098b0c

SHA1
a4d88acd5c29624b63cc698e81ba1b3e20af4a8d

SHA256
0270b739c95e00d80440ac092ffdc5d68ea372b81aa7d72e5cb478f59b9cf6fb

SHA512
4b4856842f90fcd22c39293e2fcd0d485f798981b22dc07f5cc788cf13dcb0b05b1bfd935a5a27933a8cccc9822170f6bdb6d6fb5cd4ae51634e1d30466f2f82

Download Submit
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Generator v1.0 by kidux\Dork Generator v1.0.exe
MD5
1702dc6ab7909e5ec759819d31098b0c

SHA1
a4d88acd5c29624b63cc698e81ba1b3e20af4a8d

SHA256
0270b739c95e00d80440ac092ffdc5d68ea372b81aa7d72e5cb478f59b9cf6fb

SHA512
4b4856842f90fcd22c39293e2fcd0d485f798981b22dc07f5cc788cf13dcb0b05b1bfd935a5a27933a8cccc9822170f6bdb6d6fb5cd4ae51634e1d30466f2f82

Download Submit
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Searcher Setup v1091\Dork Searcher Setup v1091.exe
MD5
c5b52d7cdded62fa3403e90942eedd46

SHA1
299127530568b243887615181dac57c1a915df25

SHA256
928f4cc0eb436fd658c63950ba57d7cf6605ab781132e92c906b63e9866c781b

SHA512
e02903773e9f7e858df7e40e92e2e5d460d6b2c91247df27d3f709a8de517140a05eea008a7fe7e2c557f50626a8dd3cb783a423529d39e91f6d4ddc8597cdbb

Download Submit
C:\Users\Admin\Downloads\DOCKERS PREMIUM PACK 2021\Dork Searcher Setup v1091\Dork Searcher Setup v1091.exe
MD5
c5b52d7cdded62fa3403e90942eedd46

SHA1
299127530568b243887615181dac57c1a915df25

SHA256
928f4cc0eb436fd658c63950ba57d7cf6605ab781132e92c906b63e9866c781b

SHA512
e02903773e9f7e858df7e40e92e2e5d460d6b2c91247df27d3f709a8de517140a05eea008a7fe7e2c557f50626a8dd3cb783a423529d39e91f6d4ddc8597cdbb

Download Submit
\??\pipe\crashpad_3592_KPRSWMSFCGKXORSA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/380-136-0x0000000000000000-mapping.dmp

Download
memory/384-138-0x0000000000000000-mapping.dmp

Download
memory/384-143-0x0000000002610000-0x0000000002612000-memory.dmp

Filesize
8KB

Download
memory/1876-132-0x0000000000000000-mapping.dmp

Download
memory/4288-121-0x0000000000000000-mapping.dmp

Download
memory/4568-144-0x0000000000000000-mapping.dmp

Download
memory/4604-133-0x0000000002C40000-0x0000000002C42000-memory.dmp

Filesize
8KB

Download
memory/4604-129-0x0000000000000000-mapping.dmp

Download
memory/4912-128-0x0000000001110000-0x0000000001112000-memory.dmp

Filesize
8KB

Download
memory/4912-123-0x0000000000000000-mapping.dmp

Download
memory/5088-127-0x0000000000000000-mapping.dmp

Download