Resubmissions
07/05/2025, 16:12
250507-tnvb6awlz7603/04/2025, 18:30
250403-w5k6xs1zhw628/06/2022, 12:30
220628-ppntjshddq1028/06/2022, 12:24
220628-pk7qvshdbl10Analysis
- max time kernel
85s - max time network
64s - platform
windows7_x64 - resource
win7-20220414-en - submitted
28/06/2022, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
- Size 71KB
- Sample220628-ppntjshddq
- SHA256 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb
- MD5 d8a44d2ed34b5fee7c8e24d998f805d9
- SHA1 d8369cb0d8ccec95b2a49ba34aa7749b60998661
- SHA512 27974ffb60f4bb726cbc8269257b9485533fa33b3229667f4b7a7019fbd410252a1006df18fcf784cca85d48da277277b552815ee5d23d9f811c263e20d115ac
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\msocache\# DECRYPT FILES BLUESKY #.txt
Ransom Note
- <<< B L U E S K Y >>> YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: -------------------------------------------------------------- 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the tor browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions --------------------------------------------------------------
URLs
-
http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion
Extracted
Path
-
C:\msocache\# DECRYPT FILES BLUESKY #.html
Ransom Note
- <!DOCTYPE html> <html> <body> <center> <font size = "6"> <p><b>B L U E S K Y</b></p> <font size = "4"> <p><b>YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED!</b></p> <p>The only way to decrypt and restore your files is with our private key and program.</p> <p>Any attempts to restore your files manually will damage your files.</p> <br> <p>To restore your files follow these instructions:</p> <p><b>1. Download and install "Tor Browser" from https://torproject.org/</p> <p>2. Run "Tor Browser"</p> <p>3. In the Tor Browser open website:</p> <p></b>http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion</p> <p><b>4. On the website enter your recovery id:</p> <p></b>RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047</p> <p><b>5. Follow the instructions on the website</b></p> </center> </body> </html>
Extracted
Path
-
C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.html
Ransom Note
- B L U E S K Y YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the Tor Browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions on the website
URLs
-
http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion
Signatures
- Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\users\admin\pictures\removewrite.tiff 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe File renamed C:\Users\Admin\Pictures\RegisterSkip.png => C:\users\admin\pictures\registerskip.png.bluesky 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe File renamed C:\Users\Admin\Pictures\RemoveWrite.tiff => C:\users\admin\pictures\removewrite.tiff.bluesky 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe File opened for modification C:\users\admin\pictures\searchwatch.tiff 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe File renamed C:\Users\Admin\Pictures\MeasureLock.crw => C:\users\admin\pictures\measurelock.crw.bluesky 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe File renamed C:\Users\Admin\Pictures\MountRemove.crw => C:\users\admin\pictures\mountremove.crw.bluesky 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe File renamed C:\Users\Admin\Pictures\SearchTrace.raw => C:\users\admin\pictures\searchtrace.raw.bluesky 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe File renamed C:\Users\Admin\Pictures\SearchWatch.tiff => C:\users\admin\pictures\searchwatch.tiff.bluesky 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe File renamed C:\Users\Admin\Pictures\SendConvertTo.tif => C:\users\admin\pictures\sendconvertto.tif.bluesky 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1672 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe 1672 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe 1672 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e4effcea8ad801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2749DF01-F6DE-11EC-85FC-5EFF8A6DE4BC} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b000000000200000000001066000000010000200000009ff95eb4e8fe0392fcbe8461a87f38de7e10f729fdd9811e5de16e088a631fe1000000000e8000000002000020000000e28bbb54db24a0fd9a3d99f50df948a05d4009146228af491336962acc4fcc5790000000d4f8f47b9b0a50bb28dcedc79d0e8949605aafdccfa931e6e9b17fd1def5830ff34e408b5721b54842ed305ef02b07740e0c76e17583161c69733ba35b44337f7985476d03c86e97fd5c1dc638cd6d7a5a92e61ca38bbaa56cad974e3a70c5bf4a771a478e6df312fce20eda0a3a72600791789189e950c1b7ae9601f588b7a9189215897faede40167c014d5156549440000000166328d15ce18d550707264610a4da4d998f7c52784584cf8251b5f3863e8095ed72dec21455947201f34426b49fe267cac7396f7fc017dbb8ad35ad26bf2e99 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b0000000002000000000010660000000100002000000008e26bf7e6b643e043378970d9f0e2e518f4d82def9aeab26089c9b228f0c69a000000000e80000000020000200000009d3208b08159dc5e367f412b16e65ba6cd9af4fedf4026cbf0996579d97b2e1920000000fa2c286cf9a793be6cb35fcb4c155cb4f4e8a32fe1b507d2f7b0d4416bb5bdb140000000a530cf50dc00c62e3e1dc028aa774bbbbcbfdb5a935b0a7ed0c90d5ba26e4a22e7dd7bd62ea03e56e24d28701e25e5376f1195ff4643aafe9ea8dda6e7f8bca5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1672 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe 1672 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe 2028 chrome.exe 1304 chrome.exe 1304 chrome.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1672 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe - Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 1672 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe 1700 iexplore.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe 1304 chrome.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1248 1700 iexplore.exe 31 PID 1700 wrote to memory of 1248 1700 iexplore.exe 31 PID 1700 wrote to memory of 1248 1700 iexplore.exe 31 PID 1700 wrote to memory of 1248 1700 iexplore.exe 31 PID 1304 wrote to memory of 396 1304 chrome.exe 33 PID 1304 wrote to memory of 396 1304 chrome.exe 33 PID 1304 wrote to memory of 396 1304 chrome.exe 33 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 1676 1304 chrome.exe 34 PID 1304 wrote to memory of 2028 1304 chrome.exe 35 PID 1304 wrote to memory of 2028 1304 chrome.exe 35 PID 1304 wrote to memory of 2028 1304 chrome.exe 35 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36 PID 1304 wrote to memory of 2024 1304 chrome.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe"C:\Users\Admin\AppData\Local\Temp\3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe"1⤵
- Modifies extensions of user files
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1672
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.txt1⤵PID:2036
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6924f50,0x7fef6924f60,0x7fef6924f702⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1112 /prefetch:22⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1152 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1704 /prefetch:82⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:12⤵PID:1500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:12⤵PID:1740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:82⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3244 /prefetch:22⤵PID:2148
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.html
- Size 1KB
- SHA256 85c2089ab426ab13cd9d11a80d7c0b92b416aab477db2a51b970179912f93e34
- MD5 e11f3f3365d89a4c7fc36cef867027a3
- SHA1 19b793c72ee43b7edc0fb6f39d45e19b0e663a25
- SHA512 3f80d9ff65add3e190cac3792ccfdbffe497d3554c38cd8cb93e7622165b590ca75ef185cab6d7474edd25b7340098568ad2f498a85baaca8cef2238c1b8f8a9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.txt
- Size 985B
- SHA256 fc35eb5b9ceb0245abf32764e77d70f9572d11f1bf606a369c8c914ee6fa9943
- MD5 fdd933640e474cbf59bb3a855b4bb074
- SHA1 1ee2241187dc358ab86325aaa455bb3e1f5fb40a
- SHA512 01a6630760e2b309a19174594c1ee254c5f53d4a2a2e7c6527484442f9f5c6cf2bc5ffddf1cea6e3ed1f00650a41640e266e9e271e2ea82437ebd89aaa83015a
- MD5 SHA1 SHA512