Resubmissions
01-02-2022 13:08
220201-qdmyjsdde8 1001-02-2022 12:57
220201-p62fzabab6 1001-02-2022 07:00
220201-hsnvdsbab7 10Analysis
-
max time kernel
384s -
max time network
429s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
01-02-2022 13:08
Static task
static1
General
-
Target
Pzszsebwqndrzimfyunhokbpqivlqwshnn.exe
-
Size
920KB
-
MD5
65523cf4b441d2dbe144566c4bea5849
-
SHA1
119d9e00c6b08f5e93f477a9429c263390e4a4c2
-
SHA256
09effc5108b5ca6e852a9712180ad493ad2e4aa5e3693056953583fbce18cf92
-
SHA512
348e742fae24048357e04e10872228438c1a327b7292944beefb0b885b7f9995d01b0aec2e0a5316cf5ac6bcc2f8afd7868076d477bf6b09791d3127b57a089b
Malware Config
Extracted
xloader
2.5
pvxz
imt-token.club
abravewayocen.online
shcloudcar.com
mshoppingworld.online
ncgf08.xyz
stuinfo.xyz
wesavetheplanetofficial.com
tourbox.xyz
believeinyourselftraining.com
jsboyat.com
aaeconomy.info
9etmorea.info
purosepeti7.com
goticketly.com
pinkmemorypt.com
mylifewellnesscentre.com
iridina.online
petrestore.online
neema.xyz
novelfooditalia.com
enterprisedaas.computer
tzkaxh.com
brainfarter.com
youniquegal.com
piiqrio.com
mdaszb.com
boldmale.com
era636.com
castleinsuranceco.com
woodennickelmusicfortwayne.com
customer-servis-kredivo.com
high-clicks.com
greetwithgadgets.com
hfsd1.com
insureagainstearthquakes.net
ultimatejump.rest
parivartanyogeshstore.com
handmanagementblog.com
meishangtianhua.com
michaelscottinsurance.net
kershoes.com
atomiccharmworks.com
conciergecompare.com
zeal-hashima.com
coachianscott.com
hwkm.net
019skz.xyz
jardingenesis.com
sumikkoremon.com
tjpengyun.com
sectionpor.xyz
46t.xyz
sa-pontianak.com
localproperty.team
dotexposed.com
cis136-tgarza.com
eiestilo.com
youknowhowtolive.com
phalcosnusa.com
qaticv93iy.com
hbjngs.com
ocean-nettoyage.com
jenuwinclothes.net
anadoluatvoffroad.com
finetipster.com
Extracted
bitrat
1.38
homeplace.kozow.com:4449
-
communication_password
f51dc802382ce2b548bf73ff0726a31d
-
tor_process
tor
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3200-206-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/1456-212-0x0000000002E70000-0x0000000002E99000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OHNPDXLXJ = "C:\\Program Files (x86)\\Llhbxnz\\sdz8mzicha0or5x.exe" svchost.exe -
Executes dropped EXE 10 IoCs
Processes:
sdz8mzicha0or5x.exeaxadtjq8.exeaxadtjq8.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 3852 sdz8mzicha0or5x.exe 2672 axadtjq8.exe 2172 axadtjq8.exe 3984 MEMZ.exe 2436 MEMZ.exe 3804 MEMZ.exe 3660 MEMZ.exe 2788 MEMZ.exe 3204 MEMZ.exe 604 MEMZ.exe -
Processes:
resource yara_rule behavioral1/memory/2172-332-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2172-334-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2172-335-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
sdz8mzicha0or5x.exeMEMZ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation sdz8mzicha0or5x.exe Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation MEMZ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Pzszsebwqndrzimfyunhokbpqivlqwshnn.exeaxadtjq8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pzszsebwqn = "C:\\Users\\Admin\\Contacts\\nqwbeszszP.url" Pzszsebwqndrzimfyunhokbpqivlqwshnn.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Iqboedthle = "C:\\Users\\Admin\\Contacts\\elhtdeobqI.url" axadtjq8.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
axadtjq8.exepid process 2172 axadtjq8.exe 2172 axadtjq8.exe 2172 axadtjq8.exe 2172 axadtjq8.exe 2172 axadtjq8.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
DpiScaling.exesvchost.exeaxadtjq8.exedescription pid process target process PID 3200 set thread context of 3040 3200 DpiScaling.exe Explorer.EXE PID 1456 set thread context of 3040 1456 svchost.exe Explorer.EXE PID 1456 set thread context of 1288 1456 svchost.exe explorer.exe PID 1456 set thread context of 800 1456 svchost.exe explorer.exe PID 2672 set thread context of 2172 2672 axadtjq8.exe axadtjq8.exe -
Drops file in Program Files directory 4 IoCs
Processes:
svchost.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Llhbxnz\sdz8mzicha0or5x.exe svchost.exe File opened for modification C:\Program Files (x86)\Llhbxnz Explorer.EXE File created C:\Program Files (x86)\Llhbxnz\sdz8mzicha0or5x.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Llhbxnz\sdz8mzicha0or5x.exe Explorer.EXE -
Drops file in Windows directory 11 IoCs
Processes:
SystemSettings.exetaskmgr.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeExplorer.EXEexplorer.exedescription ioc process File created C:\Windows\rescache\_merged\1742034116\1961760673.pri SystemSettings.exe File created C:\Windows\rescache\_merged\4183903823\97717462.pri taskmgr.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1659841449.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\2717123927\1253081315.pri Explorer.EXE File created C:\Windows\rescache\_merged\2717123927\1253081315.pri SystemSettings.exe File created C:\Windows\rescache\_merged\3060194815\1650753000.pri SystemSettings.exe File created C:\Windows\rescache\_merged\2717123927\1253081315.pri explorer.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1659841449.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1659841449.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 7 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
SystemSettings.exetaskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID SystemSettings.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
svchost.exeExplorer.EXEMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \Registry\User\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Toolbar Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
svchost.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe -
Modifies registry class 64 IoCs
Processes:
Explorer.EXEMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exetaskmgr.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionInv = "5" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 500031000000000088536b7f100041646d696e003c0009000400efbe8853537a88536b7f2e0000009b5201000000010000000000000000000000000000000396e300410064006d0069006e00000014000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 010000009eda51d1e8061dda106e603cab745732c6ac1e027c20f4254d7162c8db7afb20276a74da53786d9bdeb9c6aa3cfadeb4ffa0242b00ba3517a78f MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\FFlags = "18874369" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e4dd295d5317d801 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByDirection = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 800000003300000000000000000000000000000000000000000000000000000010000100300032002f00310037002f00320030003100390020002000300031003a00350037003a003100380000000000000000000e000000000000006d0061006c0077006100720065002d006d00610073007400650072000000000069006d000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{9F1DD008-915B-4A73-BEF3-AC6A5AF00B4D}" MicrosoftEdge.exe -
Suspicious behavior: AddClipboardFormatListener 4 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE 3040 Explorer.EXE 3040 Explorer.EXE 3040 Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exeDpiScaling.exesvchost.exechrome.exechrome.exechrome.exepid process 2744 chrome.exe 2744 chrome.exe 2284 chrome.exe 2284 chrome.exe 1472 chrome.exe 1472 chrome.exe 3200 DpiScaling.exe 3200 DpiScaling.exe 3200 DpiScaling.exe 3200 DpiScaling.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 4020 chrome.exe 4020 chrome.exe 1456 svchost.exe 1456 svchost.exe 2664 chrome.exe 2664 chrome.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 3300 chrome.exe 3300 chrome.exe 3300 chrome.exe 3300 chrome.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
chrome.exeExplorer.EXEpid process 2284 chrome.exe 3040 Explorer.EXE -
Suspicious behavior: MapViewOfSection 13 IoCs
Processes:
DpiScaling.exesvchost.exeMicrosoftEdgeCP.exepid process 3200 DpiScaling.exe 3200 DpiScaling.exe 3200 DpiScaling.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 1456 svchost.exe 4644 MicrosoftEdgeCP.exe 4644 MicrosoftEdgeCP.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
chrome.exepid process 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
DpiScaling.exesvchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3200 DpiScaling.exe Token: SeDebugPrivilege 1456 svchost.exe Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exepid process 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exepid process 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
Explorer.EXESystemSettings.exeaxadtjq8.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMicrosoftEdge.exeMicrosoftEdgeCP.exepid process 3040 Explorer.EXE 3204 SystemSettings.exe 2172 axadtjq8.exe 2172 axadtjq8.exe 3040 Explorer.EXE 3040 Explorer.EXE 3040 Explorer.EXE 3040 Explorer.EXE 3984 MEMZ.exe 2436 MEMZ.exe 3804 MEMZ.exe 3660 MEMZ.exe 3204 MEMZ.exe 2788 MEMZ.exe 604 MEMZ.exe 3040 Explorer.EXE 3040 Explorer.EXE 4356 MicrosoftEdge.exe 4644 MicrosoftEdgeCP.exe 4644 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2284 wrote to memory of 1116 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1116 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1592 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 2744 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 2744 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe PID 2284 wrote to memory of 1256 2284 chrome.exe chrome.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Pzszsebwqndrzimfyunhokbpqivlqwshnn.exe"C:\Users\Admin\AppData\Local\Temp\Pzszsebwqndrzimfyunhokbpqivlqwshnn.exe"2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8c69c4f50,0x7ff8c69c4f60,0x7ff8c69c4f703⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1660 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1608 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4280 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4316 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5076 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4280 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5192 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5000 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4452 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1416 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4976 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4528 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2428 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4592 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1668 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4720 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5168 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4812 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4296 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4712 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2440 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4720 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4620 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,12638038351005608423,8876317546404406646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:83⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\axadtjq8.exe"C:\Users\Admin\AppData\Local\Temp\axadtjq8.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\axadtjq8.exeC:\Users\Admin\AppData\Local\Temp\axadtjq8.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Llhbxnz\sdz8mzicha0or5x.exe"C:\Program Files (x86)\Llhbxnz\sdz8mzicha0or5x.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" ms-settings:display3⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe" /main3⤵
- Executes dropped EXE
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops file in Windows directory
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman1⤵
- Modifies data under HKEY_USERS
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Llhbxnz\sdz8mzicha0or5x.exeMD5
87e4bb0a76b0a2c7d3246a014ca81aba
SHA171a8281b31c8702a9c6582b01d574d3f62268d8d
SHA256376fd0e6c1f5fe65b99d7377fbb1e97ee7cd90e4d2eeeb2eaa0b6223cd784a2a
SHA5121fa170ef2ac672c51cbbcfa2515e88f5079a60586839cfb84df50f58d22b52e8c25f36fc003ba24e9a26064b94ccb064e506efbbf9939408444886424570362f
-
C:\Program Files (x86)\Llhbxnz\sdz8mzicha0or5x.exeMD5
87e4bb0a76b0a2c7d3246a014ca81aba
SHA171a8281b31c8702a9c6582b01d574d3f62268d8d
SHA256376fd0e6c1f5fe65b99d7377fbb1e97ee7cd90e4d2eeeb2eaa0b6223cd784a2a
SHA5121fa170ef2ac672c51cbbcfa2515e88f5079a60586839cfb84df50f58d22b52e8c25f36fc003ba24e9a26064b94ccb064e506efbbf9939408444886424570362f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27MD5
8ca78a5f7c6d1185833bdca7c587eeae
SHA1cb84babc09c6869b56c7e86d38ca5bae57fd2c00
SHA2569e1f94ac4eb55b274dc487354e1d803a6fdaa6e02ed6bc073afa6028479e6df4
SHA51277f387a1a1a95447fdc5bd0919e4ec6c5bef2a8786eeb892cbd08bca493c64870e1896d8aecacb1abe67397d08693c50b669b5fa614a1940a071bdf091a1b3f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27MD5
41dcc1bea8c30b44ff9b0fca15bd3650
SHA17568e9cec185b3c2f95177ffa9a5f60a9021eb36
SHA256770aff47ac3628aa6cb9ef63285045c20f179c2b2afecbf42f61fffba70d12be
SHA51278dbc7d9189b7d441144c8b7279cc885a44c75f986286411b178a59c96eac70a60b6ae9e4fbe848ca3f29868af140efccad21654e2316fcd83683a43ca81643e
-
C:\Users\Admin\AppData\Local\Temp\DB1MD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\MEMZ\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Local\Temp\axadtjq8.exeMD5
ff476c4a1f50a3bbac330d380d7f6a16
SHA1701188aee494733ad75919636b65659ff6d15bb6
SHA2569f9c0f6ab3b081afef2191c79be5bb8335317620bdd3135aed53834bd9a16c92
SHA51249ff0747dd03cdaf27387ec6b6b2451d4fa8e6ff186b2a758817523874a995523bc44a40f6f129a79c82841be91caac4c524d6d36d8533e7288ef6a7b0ce0efe
-
C:\Users\Admin\AppData\Local\Temp\axadtjq8.exeMD5
ff476c4a1f50a3bbac330d380d7f6a16
SHA1701188aee494733ad75919636b65659ff6d15bb6
SHA2569f9c0f6ab3b081afef2191c79be5bb8335317620bdd3135aed53834bd9a16c92
SHA51249ff0747dd03cdaf27387ec6b6b2451d4fa8e6ff186b2a758817523874a995523bc44a40f6f129a79c82841be91caac4c524d6d36d8533e7288ef6a7b0ce0efe
-
C:\Users\Admin\AppData\Local\Temp\axadtjq8.exeMD5
ff476c4a1f50a3bbac330d380d7f6a16
SHA1701188aee494733ad75919636b65659ff6d15bb6
SHA2569f9c0f6ab3b081afef2191c79be5bb8335317620bdd3135aed53834bd9a16c92
SHA51249ff0747dd03cdaf27387ec6b6b2451d4fa8e6ff186b2a758817523874a995523bc44a40f6f129a79c82841be91caac4c524d6d36d8533e7288ef6a7b0ce0efe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msMD5
1021aec5362eec97491ec78812636da7
SHA153f72a9ae23b3dfc99aa241ea9d0b4aed74cbb86
SHA256749af674e412f6e5dd3f26bd4c2313585d3fe784faafa82b3425c9b51daa1d3c
SHA512cbdb33cf9f79e9f0a7aafaeeed1feae54afb51510e7a2666ba42770d54f7a6eee0a2399321695e793cdfaca49fb441fa8e60d56bd0f76e7b9b2a4933045e14d5
-
C:\Users\Admin\Downloads\malware-master.zipMD5
5eba758ab6c01a378d8f67c30e327cba
SHA15e0040767b9093e337ee6384f8a2830ddf2a0f76
SHA2565d8e8e31e5529bf443f5d654a21bc0ec836520348ee91b185eb1477d67258bd6
SHA512e4a8b7760cd6e8f02ae54f9f3b0b9980a9fef6a820ccdd1a5821aefbca8469887c33e346ea216575ccca003aa0c85fd51b7317a0552124dfd8c29e469fbd3d2c
-
\??\pipe\crashpad_2284_WYBQTHFQMIUFJACEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/800-299-0x0000000004C70000-0x0000000004DB4000-memory.dmpFilesize
1.3MB
-
memory/800-261-0x0000000001110000-0x000000000111F000-memory.dmpFilesize
60KB
-
memory/1288-300-0x00000000048D0000-0x0000000004A5A000-memory.dmpFilesize
1.5MB
-
memory/1456-211-0x0000000000E20000-0x0000000000E2C000-memory.dmpFilesize
48KB
-
memory/1456-213-0x0000000003A20000-0x0000000003D40000-memory.dmpFilesize
3.1MB
-
memory/1456-212-0x0000000002E70000-0x0000000002E99000-memory.dmpFilesize
164KB
-
memory/1456-214-0x0000000003700000-0x000000000388D000-memory.dmpFilesize
1.6MB
-
memory/2172-334-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2172-332-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2172-335-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2672-226-0x0000000000550000-0x00000000005FE000-memory.dmpFilesize
696KB
-
memory/3040-215-0x0000000005440000-0x000000000554A000-memory.dmpFilesize
1.0MB
-
memory/3040-210-0x0000000003170000-0x000000000323A000-memory.dmpFilesize
808KB
-
memory/3200-208-0x00000000045A0000-0x00000000048C0000-memory.dmpFilesize
3.1MB
-
memory/3200-209-0x0000000002C90000-0x0000000002CA1000-memory.dmpFilesize
68KB
-
memory/3200-206-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/3200-205-0x0000000000B80000-0x0000000000B81000-memory.dmpFilesize
4KB
-
memory/3496-121-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB