Analysis
-
max time kernel
306s -
max time network
314s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 18:02
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Lux_Cleaner.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Lux_Cleaner.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
Lux_Cleaner.exepid process 4908 Lux_Cleaner.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Lux_Cleaner.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Lux_Cleaner.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Lux_Cleaner.exe -
Processes:
resource yara_rule C:\Users\Admin\Downloads\Lux_Cleaner.exe themida C:\Users\Admin\Downloads\Lux_Cleaner.exe themida behavioral1/memory/4908-138-0x00007FF62C0B0000-0x00007FF62CC03000-memory.dmp themida behavioral1/memory/4908-141-0x00007FF62C0B0000-0x00007FF62CC03000-memory.dmp themida behavioral1/memory/4908-143-0x00007FF62C0B0000-0x00007FF62CC03000-memory.dmp themida -
Processes:
Lux_Cleaner.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Lux_Cleaner.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Lux_Cleaner.exepid process 4908 Lux_Cleaner.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exepid process 4148 chrome.exe 4148 chrome.exe 3532 chrome.exe 3532 chrome.exe 3800 chrome.exe 3800 chrome.exe 1528 chrome.exe 1528 chrome.exe 1576 chrome.exe 1576 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1360 chrome.exe 1360 chrome.exe 400 chrome.exe 400 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
chrome.exepid process 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exepid process 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exepid process 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe 3532 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3532 wrote to memory of 1448 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 1448 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 5104 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4148 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4148 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe PID 3532 wrote to memory of 4584 3532 chrome.exe chrome.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://cdn.discordapp.com/attachments/952622190027743322/993214958307381328/Lux_Cleaner.exe2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff877264f50,0x7ff877264f60,0x7ff877264f703⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1640 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1988 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4740 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5644 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5340 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6220 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4268 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6036 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6076 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5608 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5908 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4868 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5904 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5524 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6132 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5288 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,13251310150356605289,14954155003833362395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\Lux_Cleaner.exe"C:\Users\Admin\Downloads\Lux_Cleaner.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff877264f50,0x7ff877264f60,0x7ff877264f703⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff877264f50,0x7ff877264f60,0x7ff877264f703⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD505f92457cba4d4aa36ffe12861c0269c
SHA15b609d699027402621e9e55297c8af134cde1960
SHA256aa5f623f50ade96edd47f486199f43e1250eb62c44eede7ee850c3de61ed1707
SHA512da69735ad2e043b889dde257e600cc53866fff6010bdc61da0d35b6a6f4c5fd2a61f778bb178c6856a7f473695adb71478a8a0ee3f9ec7df86a9f4c54e14c9f3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD505f92457cba4d4aa36ffe12861c0269c
SHA15b609d699027402621e9e55297c8af134cde1960
SHA256aa5f623f50ade96edd47f486199f43e1250eb62c44eede7ee850c3de61ed1707
SHA512da69735ad2e043b889dde257e600cc53866fff6010bdc61da0d35b6a6f4c5fd2a61f778bb178c6856a7f473695adb71478a8a0ee3f9ec7df86a9f4c54e14c9f3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD505f92457cba4d4aa36ffe12861c0269c
SHA15b609d699027402621e9e55297c8af134cde1960
SHA256aa5f623f50ade96edd47f486199f43e1250eb62c44eede7ee850c3de61ed1707
SHA512da69735ad2e043b889dde257e600cc53866fff6010bdc61da0d35b6a6f4c5fd2a61f778bb178c6856a7f473695adb71478a8a0ee3f9ec7df86a9f4c54e14c9f3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\Downloads\Lux_Cleaner.exeFilesize
4.3MB
MD59ba032b1423d1d5285d0a45ba21889c3
SHA10cdbb4d1ab7f6670365009257d60bb0633395a8f
SHA25649eee4c0cbb25c7d4ad7468979557fc4b4d7e8d39a109d4e47a509505e6dc8d9
SHA512d7fa10c0ff262ab01d18671e875e530b3a45d3d0e3976d70740c4b0394d136a1523d0a178ba6bd7e5328ca36da7f0517348373e304682911774040b5b5973133
-
C:\Users\Admin\Downloads\Lux_Cleaner.exeFilesize
4.3MB
MD59ba032b1423d1d5285d0a45ba21889c3
SHA10cdbb4d1ab7f6670365009257d60bb0633395a8f
SHA25649eee4c0cbb25c7d4ad7468979557fc4b4d7e8d39a109d4e47a509505e6dc8d9
SHA512d7fa10c0ff262ab01d18671e875e530b3a45d3d0e3976d70740c4b0394d136a1523d0a178ba6bd7e5328ca36da7f0517348373e304682911774040b5b5973133
-
\??\pipe\crashpad_3532_XCWWSRJWADMZLQWEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4908-135-0x0000000000000000-mapping.dmp
-
memory/4908-138-0x00007FF62C0B0000-0x00007FF62CC03000-memory.dmpFilesize
11.3MB
-
memory/4908-139-0x00007FF62C0B1000-0x00007FF62C0B5000-memory.dmpFilesize
16KB
-
memory/4908-140-0x00007FF894AB0000-0x00007FF894CA5000-memory.dmpFilesize
2.0MB
-
memory/4908-141-0x00007FF62C0B0000-0x00007FF62CC03000-memory.dmpFilesize
11.3MB
-
memory/4908-142-0x00007FF894AB0000-0x00007FF894CA5000-memory.dmpFilesize
2.0MB
-
memory/4908-143-0x00007FF62C0B0000-0x00007FF62CC03000-memory.dmpFilesize
11.3MB
-
memory/4908-144-0x00007FF894AB0000-0x00007FF894CA5000-memory.dmpFilesize
2.0MB