Resubmissions
21-08-2022 14:53
220821-r9e39aahej 820-08-2022 19:34
220820-yajeysada3 818-08-2022 19:56
220818-ynvp5seac3 814-08-2022 21:38
220814-1hgbnsddf5 818-07-2022 04:40
220718-fajfvaafdl 118-07-2022 04:26
220718-e2lvlsaegj 816-07-2022 04:29
220716-e4rtmsgeg3 816-07-2022 03:58
220716-ejzczsgde2 811-07-2022 19:19
220711-x1h2facabn 1010-07-2022 23:55
220710-3yffesdfan 10Analysis
-
max time kernel
385s -
max time network
391s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2022 04:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://google.com
Resource
win10v2004-20220414-en
General
-
Target
https://google.com
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ChromeRecovery.exepid process 2016 ChromeRecovery.exe -
Drops file in Program Files directory 7 IoCs
Processes:
elevation_service.exedescription ioc process File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_306436945\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_306436945\ChromeRecovery.exe elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_306436945\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_306436945\manifest.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_306436945\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_306436945\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_306436945\ChromeRecoveryCRX.crx elevation_service.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exetaskmgr.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exepid process 4444 chrome.exe 4444 chrome.exe 4260 chrome.exe 4260 chrome.exe 3900 chrome.exe 3900 chrome.exe 4124 chrome.exe 4124 chrome.exe 3152 chrome.exe 3152 chrome.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 4896 chrome.exe 4896 chrome.exe 1464 chrome.exe 1464 chrome.exe 1864 chrome.exe 1864 chrome.exe 3888 chrome.exe 3888 chrome.exe 3900 chrome.exe 3900 chrome.exe 4976 chrome.exe 4976 chrome.exe 2756 chrome.exe 2756 chrome.exe 2244 chrome.exe 2244 chrome.exe 2684 chrome.exe 2684 chrome.exe 2684 chrome.exe 2684 chrome.exe 736 chrome.exe 736 chrome.exe 4936 chrome.exe 4936 chrome.exe 2896 chrome.exe 2896 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
Processes:
chrome.exepid process 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 3688 taskmgr.exe Token: SeSystemProfilePrivilege 3688 taskmgr.exe Token: SeCreateGlobalPrivilege 3688 taskmgr.exe Token: 33 3688 taskmgr.exe Token: SeIncBasePriorityPrivilege 3688 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exetaskmgr.exepid process 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exetaskmgr.exepid process 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3900 chrome.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe 3688 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exechrome.exedescription pid process target process PID 3900 wrote to memory of 4156 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4156 3900 chrome.exe chrome.exe PID 812 wrote to memory of 1028 812 chrome.exe chrome.exe PID 812 wrote to memory of 1028 812 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 3900 wrote to memory of 4956 3900 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe PID 812 wrote to memory of 4972 812 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://google.com1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba5fb4f50,0x7ffba5fb4f60,0x7ffba5fb4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2060 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2296 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4656 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4784 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4808 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4764 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4760 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3056 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3604 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5576 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1584 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4748 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5104 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3276 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5412 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3316 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4616 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5484 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1204 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,302684854859299720,5479038951727894329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5836 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba5fb4f50,0x7ffba5fb4f60,0x7ffba5fb4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1664,12823102710598597253,3411819657907659432,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1668 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1664,12823102710598597253,3411819657907659432,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1976 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_306436945\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_306436945\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={4f692521-272a-4ad3-b40d-0702171d8de1} --system2⤵
- Executes dropped EXE
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_306436945\ChromeRecovery.exeFilesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD59cf54f530ba6a610daf714720e13c88d
SHA1d7b81de2614ede4de87bc8ffab96db86cbd96974
SHA2560bec3c69d6a16dd80faf449719f631f35869db12f0c3ce52463cd5dff6eb48b2
SHA51209df43dae6a82cc21700047de6c492c55f722f1b19a0613362d95cef3a578533aaca682254839346d4600ddb345243af1d6e585204ccf3344eb7123421caa8dd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD59cf54f530ba6a610daf714720e13c88d
SHA1d7b81de2614ede4de87bc8ffab96db86cbd96974
SHA2560bec3c69d6a16dd80faf449719f631f35869db12f0c3ce52463cd5dff6eb48b2
SHA51209df43dae6a82cc21700047de6c492c55f722f1b19a0613362d95cef3a578533aaca682254839346d4600ddb345243af1d6e585204ccf3344eb7123421caa8dd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD59cf54f530ba6a610daf714720e13c88d
SHA1d7b81de2614ede4de87bc8ffab96db86cbd96974
SHA2560bec3c69d6a16dd80faf449719f631f35869db12f0c3ce52463cd5dff6eb48b2
SHA51209df43dae6a82cc21700047de6c492c55f722f1b19a0613362d95cef3a578533aaca682254839346d4600ddb345243af1d6e585204ccf3344eb7123421caa8dd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD59cf54f530ba6a610daf714720e13c88d
SHA1d7b81de2614ede4de87bc8ffab96db86cbd96974
SHA2560bec3c69d6a16dd80faf449719f631f35869db12f0c3ce52463cd5dff6eb48b2
SHA51209df43dae6a82cc21700047de6c492c55f722f1b19a0613362d95cef3a578533aaca682254839346d4600ddb345243af1d6e585204ccf3344eb7123421caa8dd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
71KB
MD56ffa913d6167e3a336a2d08b97ed5ad6
SHA15d4e47878ba6492342c4d257c2d1bcd08cf224e9
SHA2561b39f79dd5c614a83cf7973f1f8a7f4334983e21d5159cdb6f80de89bf70c94b
SHA51248803741dacd9724c121f66d9868d626a5a0e5783aaf47577700b5ca0a2cc456cd362747e7808cdb28a7aa4f52d56696390ea37d14a97cad55a0da587800c84b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
28KB
MD508ae3ca129ee89d8a35fbb5ec6e50ca0
SHA11befa8c9a60e617543d313003d147f2b14f63978
SHA2563c67a0235bd3cb034ba2682636af22a33c7b903343b437b21d7c5413031239fb
SHA512c20a018eda147b383f10303da869b587c152501a76515980e6861410ff8d53552427bf3ae96ca64ab0934aba7dd69bc8027df42427ebd2b4201fc86a2c417f0a
-
\??\pipe\crashpad_3900_KQCJSBPWCCNKIUIRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_812_IUNDHSOWYIDQESEWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2016-140-0x0000000000000000-mapping.dmp