Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/03/2022, 05:48

220312-ghnwzagde8 10

12/03/2022, 05:21

220312-f2e8hagag8 1

Analysis

  • max time kernel
    830s
  • max time network
    1776s
  • platform
    windows10_x64
  • resource
    win10-20220223-en
  • submitted
    12/03/2022, 05:48

General

  • Target

    https://share.riseup.net/#eRUpzFmrLsUdVwjwnPu4QQ

Malware Config

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • PlugX Rat Payload 4 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 27 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 30 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://share.riseup.net/#eRUpzFmrLsUdVwjwnPu4QQ
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe6aef4f50,0x7ffe6aef4f60,0x7ffe6aef4f70
      2⤵
        PID:2512
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1664 /prefetch:2
        2⤵
          PID:1564
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1720 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3996
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 /prefetch:8
          2⤵
            PID:3804
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
            2⤵
              PID:4064
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
              2⤵
                PID:4028
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4716 /prefetch:8
                2⤵
                  PID:528
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:780
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4268 /prefetch:8
                  2⤵
                    PID:1680
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4264 /prefetch:8
                    2⤵
                      PID:1976
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4236 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2284
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4104 /prefetch:8
                      2⤵
                        PID:2808
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4156 /prefetch:8
                        2⤵
                          PID:2292
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4232 /prefetch:8
                          2⤵
                            PID:3672
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4360 /prefetch:8
                            2⤵
                              PID:3764
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:8
                              2⤵
                                PID:932
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:8
                                2⤵
                                  PID:2688
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
                                  2⤵
                                    PID:3456
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
                                    2⤵
                                      PID:3496
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:224
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5368 /prefetch:8
                                      2⤵
                                        PID:1456
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2192
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3912
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4248 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2760
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3404 /prefetch:8
                                        2⤵
                                          PID:2528
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1680
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2016 /prefetch:8
                                          2⤵
                                            PID:3120
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 /prefetch:8
                                            2⤵
                                              PID:3980
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5264 /prefetch:2
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:604
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3356 /prefetch:8
                                              2⤵
                                                PID:3740
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:8
                                                2⤵
                                                  PID:3472
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
                                                  2⤵
                                                    PID:524
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
                                                    2⤵
                                                      PID:416
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5772 /prefetch:8
                                                      2⤵
                                                        PID:2572
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
                                                        2⤵
                                                          PID:3844
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5616 /prefetch:8
                                                          2⤵
                                                            PID:2364
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                                                            2⤵
                                                              PID:228
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
                                                              2⤵
                                                                PID:3788
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1956
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1616 /prefetch:1
                                                                2⤵
                                                                  PID:340
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:8
                                                                  2⤵
                                                                    PID:4056
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5264 /prefetch:8
                                                                    2⤵
                                                                      PID:1924
                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\97.278.200\software_reporter_tool.exe
                                                                      "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\97.278.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=eCTcqcdel+voulqrUXzYUeXIg1ivF6J0KgbGVLgQ --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1168
                                                                      • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe
                                                                        "c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=97.278.200 --initial-client-data=0x250,0x254,0x258,0x238,0x25c,0x7ff6e0ff69d8,0x7ff6e0ff69e8,0x7ff6e0ff69f8
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1868
                                                                      • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe
                                                                        "c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_1168_YRLLIYQMXGTPMZAC" --sandboxed-process-id=2 --init-done-notifier=720 --sandbox-mojo-pipe-token=8264403413588796795 --mojo-platform-channel-handle=696 --engine=2
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2536
                                                                        • C:\Windows\system32\WerFault.exe
                                                                          C:\Windows\system32\WerFault.exe -u -p 2536 -s 692
                                                                          4⤵
                                                                          • Program crash
                                                                          PID:1828
                                                                      • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe
                                                                        "c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_1168_YRLLIYQMXGTPMZAC" --sandboxed-process-id=3 --init-done-notifier=924 --sandbox-mojo-pipe-token=268720662790365392 --mojo-platform-channel-handle=920
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1900
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5764 /prefetch:8
                                                                      2⤵
                                                                        PID:1652
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
                                                                        2⤵
                                                                          PID:896
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:8
                                                                          2⤵
                                                                            PID:3308
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:8
                                                                            2⤵
                                                                              PID:1168
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:8
                                                                              2⤵
                                                                                PID:1032
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                                                                                2⤵
                                                                                  PID:2856
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
                                                                                  2⤵
                                                                                    PID:3988
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                                                                                    2⤵
                                                                                      PID:2156
                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                    1⤵
                                                                                      PID:684
                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\joom_new\josn_content.csv"
                                                                                      1⤵
                                                                                      • Checks processor information in registry
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3976
                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\joom_new\josn_users.csv"
                                                                                      1⤵
                                                                                      • Checks processor information in registry
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3412
                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\Ufih060515\if9pk_ucm_history.csv"
                                                                                      1⤵
                                                                                      • Checks processor information in registry
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:612
                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\Ufih060515\if9pk_messages.csv"
                                                                                      1⤵
                                                                                      • Checks processor information in registry
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:4036
                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\Ufih060515\if9pk_users.csv"
                                                                                      1⤵
                                                                                      • Checks processor information in registry
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:3748
                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\Ufih060515\if9pk_user_usergroup_map.csv"
                                                                                      1⤵
                                                                                      • Checks processor information in registry
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:1096
                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\mirari\first_forums.csv"
                                                                                      1⤵
                                                                                      • Checks processor information in registry
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:3336
                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\mirari\first_search_words.csv"
                                                                                      1⤵
                                                                                      • Checks processor information in registry
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:1156
                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\mirari\first_users.csv"
                                                                                      1⤵
                                                                                      • Checks processor information in registry
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:3632

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v6

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • memory/612-553-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-536-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-530-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-529-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-527-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-528-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-526-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-532-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-555-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-551-0x00007FFE75790000-0x00007FFE7583E000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                    • memory/612-534-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-538-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-539-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-531-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-542-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-544-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-546-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/612-548-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/2536-523-0x00007FFE771C0000-0x00007FFE771C1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/2536-524-0x00007FFE771D0000-0x00007FFE771D1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/3412-329-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-321-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-320-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-322-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-324-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-325-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-326-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-327-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-328-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-318-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-330-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-333-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-335-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-337-0x00007FFE75790000-0x00007FFE7583E000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                    • memory/3412-340-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-343-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-319-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-317-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3412-314-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3412-313-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3412-312-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3412-311-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3976-158-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-137-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-308-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3976-307-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3976-306-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3976-305-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3976-164-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-162-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-160-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-310-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-156-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-154-0x00007FFE75790000-0x00007FFE7583E000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                    • memory/3976-152-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-150-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-148-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-144-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-146-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-139-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-142-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-309-0x00007FFE75790000-0x00007FFE7583E000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                    • memory/3976-135-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-134-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-133-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-132-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-130-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-131-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-129-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-128-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-127-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/3976-118-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3976-117-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3976-116-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3976-115-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4036-816-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/4036-815-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/4036-817-0x00007FFE77260000-0x00007FFE7743B000-memory.dmp

                                                                                      Filesize

                                                                                      1.9MB

                                                                                    • memory/4036-1093-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4036-1094-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4036-1095-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4036-1096-0x00007FFE372F0000-0x00007FFE37300000-memory.dmp

                                                                                      Filesize

                                                                                      64KB