Analysis
-
max time kernel
582s -
max time network
579s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 13:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.incs.com.ph/cgi-sys/bxd.cgi?a=jgrosas@incs.com.ph&id=LlTsWlMFpKwbJXqnzj1cZ-1653387130
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
http://www.incs.com.ph/cgi-sys/bxd.cgi?a=jgrosas@incs.com.ph&id=LlTsWlMFpKwbJXqnzj1cZ-1653387130
Resource
win10v2004-20220414-en
General
-
Target
http://www.incs.com.ph/cgi-sys/bxd.cgi?a=jgrosas@incs.com.ph&id=LlTsWlMFpKwbJXqnzj1cZ-1653387130
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b0000000002000000000010660000000100002000000094e56c19a9c88ab3434079f604aa5840639604c07584231160dfa3e8660502c6000000000e8000000002000020000000908c67e6c35675ac5e76dd85e04a94472f0eeaaba4ef29f65e7beae08a8b4cce2000000029bfed50b7767004fd26b7326de4e75bddb89ffc571b254b0b84d5855caf480040000000df5c1498536d05810f7376a0bca97e808401fa9144d069ea6c2536cf8a0f31f7b95ae98a947f82a6052dca41e60e703df2b3dd7a4f5845d80a58881b3ff7528c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "360164456" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAADC421-DB66-11EC-917F-6AE7990DC39D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003ee894736fd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000d1b792460ee3491dfe9e806e92b3f63e956b2e0dcd51dee38bbc460acab99a95000000000e8000000002000020000000ffb7f179f65c0965146a14492ff0f6ffb9b4e13820139a4fb6e348abde622717900000003aacc1cae31dc5c6a8771133fc87277191cc85510a9a41438984a49ebe7e488694c34195be76e840136cf14d4204095d649293f93e967943f8cce50bfe953857232346e004cf5200f4212059a834c887ceb73ab34d8fbddc5b2e90ba79f6d5b1dbf62afa9d4cd2738bba7f3c082197df49228e91da5ad02c163144b249f7d2aeee068480e8f174d4b6dfd119fb7419ab40000000a1a52abf9a4f9635e93d1a63345132cd1ea00e153aebe55515830a36dbd6a22120de79c6f6ae10bfadd0e725ef71abc3c9c6891669242842075555893987908d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exepid process 1088 chrome.exe 1992 chrome.exe 1992 chrome.exe 3004 chrome.exe 1992 chrome.exe 1992 chrome.exe 2068 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
iexplore.exechrome.exepid process 1668 iexplore.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1668 iexplore.exe 1668 iexplore.exe 1064 IEXPLORE.EXE 1064 IEXPLORE.EXE 1064 IEXPLORE.EXE 1064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 1668 wrote to memory of 1064 1668 iexplore.exe IEXPLORE.EXE PID 1668 wrote to memory of 1064 1668 iexplore.exe IEXPLORE.EXE PID 1668 wrote to memory of 1064 1668 iexplore.exe IEXPLORE.EXE PID 1668 wrote to memory of 1064 1668 iexplore.exe IEXPLORE.EXE PID 1992 wrote to memory of 1940 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1940 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1940 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 528 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1088 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1088 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1088 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe PID 1992 wrote to memory of 1080 1992 chrome.exe chrome.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.incs.com.ph/cgi-sys/bxd.cgi?a=jgrosas@incs.com.ph&id=LlTsWlMFpKwbJXqnzj1cZ-16533871301⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef62e4f50,0x7fef62e4f60,0x7fef62e4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1048 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1288 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1804 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3264 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3416 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3576 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1524 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1292 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1764 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5400 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5484 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1360 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1772 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,3391510595663144696,2440152009126009177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=628 /prefetch:82⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD511c5f7ddd72a321929791ea40ead24dc
SHA15459d5009e4b01c3f1bef43ca42781e63d22d8cd
SHA256a1b488756187c5e63cae12f3c7e81661015ccb2f1477a8cd336aa52a64d50aed
SHA512e9db21a743af472d12046ff87afd0c99422700edfbaeef84c206e7593a35603c87879100e482ec457e4ef0180848c5be5d81f367fb2377b96433b850b6e7ff4e
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ezmz917\imagestore.datFilesize
8KB
MD5370d0ab576a2ba362edc4ce61e8de470
SHA1e0849b5e405190049a25edacf86239d6ee4861b7
SHA256de80239df6ce2063bd422729a92873c6f6ef8ee594c2659852c703cec49568d5
SHA51235712e575b2c3759347fd3e3a6829fe9b83a234e65eed1f577b30e1393f584e990dbeb1b750b3b791a9558039de303f2651f10f17c7f7e23b5330adc94d2c202
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\P5ETXJIX.txtFilesize
606B
MD5c4208f11431e32a3f0e479203afc6c2e
SHA1627c559d0d678a062135f04313872dbe2cc8728f
SHA2562da7ade03b94903da2822c7dcc48b1434bd226bf60e43634641772f144aa8e1e
SHA5123931a8db0002737736dcf9227f335d46b26833484738fc8625533b823c2a80d0b423ee2293b4ed59b4af7107a806938802da8a2cf42fa6680d3bb76ebf327cd6
-
\??\pipe\crashpad_1992_GQFVPBDPACJPGELQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e