Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
01-02-2022 09:04
Static task
static1
General
-
Target
ddbf17981fed857e966ff809166b6d320e04d8527690090db8c51cd604ea4b9f.exe
-
Size
42KB
-
MD5
9119c48e34aa0b5b10732abb8a899377
-
SHA1
c5a0c2dc7507ade864018a783cf12587f6cfc8d6
-
SHA256
ddbf17981fed857e966ff809166b6d320e04d8527690090db8c51cd604ea4b9f
-
SHA512
1cd03786a39de37b9e087626ca1ddbb3b4f6e26e6d54c790d7035a6f9e7fb468d9b4186f86c6c58f86b769fee83afd7c88da18f73ec4c44567215fa11fd05945
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
exe_type
loader
Extracted
Family
gozi_rm3
Botnet
202003272
C2
https://lidesignexpo.com
Attributes
-
build
300854
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
serpent.plain
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073ba28bec77bbe4ba4dd58ffcd9527ce000000000200000000001066000000010000200000008ef2a7b06bd84b7219f2799253d229cc6e862d30458772b979d632091f5cbd70000000000e8000000002000020000000617589c389cd6e56f8c82b6281b76ef35ffb845e85ee5936e4d578d581b491d0200000001a4509c296d29db1331015244005944789fa984e97e2a23739f04f2a6ed234d240000000e7556900392dacabc6d2035a7ca03ae73360d57c685e64cf79921416af5f7be3906da87473250145835a30ba92f3cf035bc622260931539fce025e1b8a67a12b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4061375224" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30928671" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1077cc1d20efd701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{334F2E82-5B13-11EC-876A-E63C55DA7BCE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d146f61fefd701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073ba28bec77bbe4ba4dd58ffcd9527ce000000000200000000001066000000010000200000000f59c4d4e3d63a410d0858843b89ca8b47666b7bfb3b033181124dfeeb432d43000000000e8000000002000020000000b33eb146192165dbaae8bcb4387972e4ea3bfea8b3f71e19f3ddf7833b724824200000000dcbffe806961fb6ec6ad3a81455001a4e1d4d8bf1b7fdc435fa856543d42c40400000005e6dafec11dd5b6a4be88d5a41c560c4a53dc93e7951601207e23ce45a0cf1766fba79b505dbd55c04adbbc3d0583ee86b63f17473d94c4a23d7c8c5685d5f5c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073ba28bec77bbe4ba4dd58ffcd9527ce00000000020000000000106600000001000020000000e71b5c08da1e869a50d565e86ceb085c37f338109dff8dffe439323776e853db000000000e8000000002000020000000742325f77d716f79354b96172f7922a1d42b08aaf5bdf8a7af09b9b017f30202200000000321db76e321cd99ffdf2128759fe1d1d9ef9aa4e7df7f98a546cdafa18c8af54000000067220ffc64555b76c277c15c1575a7bc5fe00de208fac539cdffa5c8c21921af84bd167668656fed3896179aae34bd6bf35138071e5fc91eaaf8a3951c4608db iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0011c72a20efd701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073ba28bec77bbe4ba4dd58ffcd9527ce0000000002000000000010660000000100002000000025fff91ff0a5933756c88749bacc1064024961b94ed4372244bfb70fc0409213000000000e8000000002000020000000d656e9ec44f6ea32ba752e5d6ecfce88db232ecbc67fd7f286bc40c58b26676420000000573ff5fd0aecba11723df7538e5312d9f9e6481c08a058d4d0ebb672d5ae20dd4000000047c9a34c8ab6e60b59095a3427c0c716c45d5da0f0b8e89d4d223d64d2e224f817c221fbaeac6a7812ae3443c514c06e9a30bfda7cf6d1f73b9b3ee9c3c1ae55 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4061375224" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30928671" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 424 chrome.exe 424 chrome.exe 676 chrome.exe 676 chrome.exe 648 chrome.exe 648 chrome.exe 3268 chrome.exe 3268 chrome.exe 4460 chrome.exe 4460 chrome.exe 4508 chrome.exe 4508 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 3540 iexplore.exe 3540 iexplore.exe 1680 iexplore.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 2776 iexplore.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 1420 iexplore.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 4296 iexplore.exe 4564 iexplore.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe 676 chrome.exe -
Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 3540 iexplore.exe 3540 iexplore.exe 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 3540 iexplore.exe 3540 iexplore.exe 3212 IEXPLORE.EXE 3212 IEXPLORE.EXE 1680 iexplore.exe 1680 iexplore.exe 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2776 iexplore.exe 2776 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 1420 iexplore.exe 1420 iexplore.exe 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 4296 iexplore.exe 4296 iexplore.exe 4344 IEXPLORE.EXE 4344 IEXPLORE.EXE 4564 iexplore.exe 4564 iexplore.exe 4612 IEXPLORE.EXE 4612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3540 wrote to memory of 2896 3540 iexplore.exe 72 PID 3540 wrote to memory of 2896 3540 iexplore.exe 72 PID 3540 wrote to memory of 2896 3540 iexplore.exe 72 PID 3540 wrote to memory of 3212 3540 iexplore.exe 73 PID 3540 wrote to memory of 3212 3540 iexplore.exe 73 PID 3540 wrote to memory of 3212 3540 iexplore.exe 73 PID 1680 wrote to memory of 2036 1680 iexplore.exe 75 PID 1680 wrote to memory of 2036 1680 iexplore.exe 75 PID 1680 wrote to memory of 2036 1680 iexplore.exe 75 PID 676 wrote to memory of 3168 676 chrome.exe 80 PID 676 wrote to memory of 3168 676 chrome.exe 80 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 3812 676 chrome.exe 81 PID 676 wrote to memory of 424 676 chrome.exe 82 PID 676 wrote to memory of 424 676 chrome.exe 82 PID 676 wrote to memory of 2080 676 chrome.exe 83 PID 676 wrote to memory of 2080 676 chrome.exe 83 PID 676 wrote to memory of 2080 676 chrome.exe 83 PID 676 wrote to memory of 2080 676 chrome.exe 83 PID 676 wrote to memory of 2080 676 chrome.exe 83 PID 676 wrote to memory of 2080 676 chrome.exe 83 PID 676 wrote to memory of 2080 676 chrome.exe 83 PID 676 wrote to memory of 2080 676 chrome.exe 83 PID 676 wrote to memory of 2080 676 chrome.exe 83 PID 676 wrote to memory of 2080 676 chrome.exe 83 PID 676 wrote to memory of 2080 676 chrome.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddbf17981fed857e966ff809166b6d320e04d8527690090db8c51cd604ea4b9f.exe"C:\Users\Admin\AppData\Local\Temp\ddbf17981fed857e966ff809166b6d320e04d8527690090db8c51cd604ea4b9f.exe"1⤵PID:652
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2896
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:82947 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3212
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff96d0c4f50,0x7ff96d0c4f60,0x7ff96d0c4f702⤵PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1560 /prefetch:22⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1752 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2360 /prefetch:82⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2740 /prefetch:12⤵PID:1360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:12⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:12⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:12⤵PID:4200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1540,15048969996055602754,14398466077115709889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4508
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:2900
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2972
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1420 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4296 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:4344
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4564 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:4612
-