56fea1fea906e0f79b7d1d403c45fe5210a0431bb09bd02c0ebe4963c8378bff

General

Target

edde74a64c844a5508f3fd19a6f4ce5f5ae9226b4a41b806aee4ea4640b5ebd3.html
Size

107KB
MD5

54f62d23772b2788189852b979dae2a6
SHA1

7221fa92302e9e235b8fde46da3447656c0d00e1
SHA256

edde74a64c844a5508f3fd19a6f4ce5f5ae9226b4a41b806aee4ea4640b5ebd3
SHA512

9d49f94952c653943a3f6aebb0b0a6749332303197afb696b72adb7fff4f5be793d24d2f28b97c52803a2e669412444f0a8a39d3302e1189702b124c420b81c1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902e58799091d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363915207"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9DD30A51-FD83-11EC-B804-4A8CA62BDB03} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc30c9ea3942204d8d7931c03dc9524d00000000020000000000106600000001000020000000e8c076a82e178c22bc730b8b2b0e3895eeb8433d4f6c93063a86414be6843422000000000e8000000002000020000000ffdaaf2f205bd3ef7cc97698b3fa18f283af900d7b31b90a7712f8e253e98f7d200000004aea1204bfd3f036a66daef65d1f275ed430f35fca7b7e75f98f4caa1c08788340000000408f2d384abb0a7a38cc7eb3528babdda304753cb742018d462e7deac9420999347281142f063c7d8044e3aabf0c2f78cc637b9ca8c822d4e42a8bc0eedad66c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "363963792"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30970256"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30970256"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1981451651"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30970256"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0aa42799091d801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1921139366"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "363931801"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1921139366"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc30c9ea3942204d8d7931c03dc9524d0000000002000000000010660000000100002000000088f2f6134ad5454d0bfc2f9ffff6c2f20c0390c2e73504b5750cc6d11930cdbb000000000e80000000020000200000005a03a6d4ac440e558fc663d98f3c1043bbd197a5d7a82738f25c991833d354e420000000e9fdd096b1ccf9d1e43cac0e8c2669e850e2184e35b3e9c28e67eaec6ff42eae400000008a68169e0e50029caf71b632f1dc023e286a13213ec4219a5272697854fab6b14ad53cf88e8397453c41b696ae4afecff442972f48106c979082cf82ed0fbde9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
4748	chrome.exe
4748	chrome.exe
2376	chrome.exe
2376	chrome.exe
4400	chrome.exe
4400	chrome.exe
4376	chrome.exe
4376	chrome.exe
3732	chrome.exe
3648	chrome.exe
3732	chrome.exe
3648	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

2376 chrome.exe
2376 chrome.exe
2376 chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

iexplore.exechrome.exe

pid	process
2368	iexplore.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2368 iexplore.exe
2368 iexplore.exe
2636 IEXPLORE.EXE
2636 IEXPLORE.EXE
2636 IEXPLORE.EXE
2636 IEXPLORE.EXE
2368 iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exechrome.exe

description	pid	process	target process
PID 2368 wrote to memory of 2636	2368	iexplore.exe	IEXPLORE.EXE
PID 2368 wrote to memory of 2636	2368	iexplore.exe	IEXPLORE.EXE
PID 2368 wrote to memory of 2636	2368	iexplore.exe	IEXPLORE.EXE
PID 2376 wrote to memory of 5032	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 5032	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4712	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4748	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 4748	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe
PID 2376 wrote to memory of 3784	2376	chrome.exe	chrome.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edde74a64c844a5508f3fd19a6f4ce5f5ae9226b4a41b806aee4ea4640b5ebd3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2636

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\edde74a64c844a5508f3fd19a6f4ce5f5ae9226b4a41b806aee4ea4640b5ebd3.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa13174f50,0x7ffa13174f60,0x7ffa13174f70
2⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1596 /prefetch:2
2⤵
PID:4712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1652 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 /prefetch:8
2⤵
PID:3784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
2⤵
PID:4076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
2⤵
PID:3984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4120 /prefetch:8
2⤵
PID:4228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:8
2⤵
PID:4144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4364 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4776 /prefetch:8
2⤵
PID:1796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:8
2⤵
PID:992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:8
2⤵
PID:652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
2⤵
PID:4064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1336,4174273373084828305,9363750842848140404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4296 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
f46df6d8b4b4db4e1dc315559df90120

SHA1
6e276344ce29422caf44382d1976bca7bf06c6ed

SHA256
202f370ff58874e4e5e56ff634031c48ef1ee599db976ebd25790c65f8780ac2

SHA512
b32a203bfaabef4763f1c0de9398d52da1465c234b82da541e9987d5114efae93e391d8437018f0c34d70464d5c9b1fb3c084b3adb5ad430f7cb3459aed42706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
6dc527a61ef95eca726b03875a464975

SHA1
231c3c8de4607af41f788e7b72d4fe86803c90c6

SHA256
0c613be7a3173b32542018fc1c60bada4784e6e17340d5ef4ffae6b5ea6e31ed

SHA512
5570751fcfeaa178393e13124b36c10a9a4bff1bac68a969dbd1ad99b3cfa5e52b31b49995bbe9ac35f20e425caa247406b0114ac0a400c4a1b7ca07d36ad212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WH8AM2Y5.cookie
Filesize
611B

MD5
cb8cf6409ab7abc73e1bc5566a8922f5

SHA1
99e43cf4c3af88f2f87bd962be8500b15f6f2844

SHA256
78a7e22026cc75466842fa3cb83c55e9754ae1d2218704f82e91e422b88b44ac

SHA512
080c9ade6e11220973d8110bf9348734ce06b7682822e024c0d3843ae0e6466a77ac07b6ffaf41f62639895c2411f38c72d37a02da43c980fd6d728bde7abfd6

Download Submit
\??\pipe\crashpad_2376_WGUNUHXYXATJHZBF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads