hxxps://secure-web[.]cisco[.]com/1ELSiFNkDDcSx-trt_wLUMw_RiS1Y-2G77ua3rCp_fqqvQDi6WZVGuIE1LrvmE2KHip1cf0ziwDI6xfNPmXpSgQDHDq9ZwtuNI8KMcWyuAySzxTm49ZwYC9PdbolJCkLd882f8NDt2V8syRPjZ9YvlLzkFQ21fvf9vhptE2Wk0a_CZauVSLZ2QBHwOLpLBtKXNNcbUsKNRszNDucwAigHVCivybQzACo_R1cBoegz4jbmiKGBc7OXyZEHQHdr1bKf_XiTddOA0XAY2KMjGVbZrLPxtAomXpcTLR4GzOKlQ1SSmXrGUflkWQVxU9adrhj8/https%3A%2F%2Fycrms-tqaaa-aaaad-qdlkq-cai[.]raw[.]ic0[.]app%2Flogin2[.]html%3Fatqcrt%3D4OIpWjjHapS5ne8Vtt5FAB4dwz%26qxomhgm%3DIGT98ECRAREGFf8PJ4zvbLqu%26eoibnnpkd%3DfmONE44c9YG5uIuZ2kchvm8kkWYX%26wunazw%3DkUHmhLQEF2OBDbclEhgQeQ%26krguqcvd%3DmXX9CH4uaA9XJ6m%26mvplqtbus%3DLGljjBuJFJ9fTzJE%26username%3Dmiao[.]zhang%40dot[.]wi[.]gov

General

Target

https://secure-web.cisco.com/1ELSiFNkDDcSx-trt_wLUMw_RiS1Y-2G77ua3rCp_fqqvQDi6WZVGuIE1LrvmE2KHip1cf0ziwDI6xfNPmXpSgQDHDq9ZwtuNI8KMcWyuAySzxTm49ZwYC9PdbolJCkLd882f8NDt2V8syRPjZ9YvlLzkFQ21fvf9vhptE2Wk0a_CZauVSLZ2QBHwOLpLBtKXNNcbUsKNRszNDucwAigHVCivybQzACo_R1cBoegz4jbmiKGBc7OXyZEHQHdr1bKf_XiTddOA0XAY2KMjGVbZrLPxtAomXpcTLR4GzOKlQ1SSmXrGUflkWQVxU9adrhj8/https%3A%2F%2Fycrms-tqaaa-aaaad-qdlkq-cai.raw.ic0.app%2Flogin2.html%3Fatqcrt%3D4OIpWjjHapS5ne8Vtt5FAB4dwz%26qxomhgm%3DIGT98ECRAREGFf8PJ4zvbLqu%26eoibnnpkd%3DfmONE44c9YG5uIuZ2kchvm8kkWYX%26wunazw%3DkUHmhLQEF2OBDbclEhgQeQ%26krguqcvd%3DmXX9CH4uaA9XJ6m%26mvplqtbus%3DLGljjBuJFJ9fTzJE%26username%3Dmiao.zhang%40dot.wi.gov

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BB96161-14E5-11ED-8798-7E2F64CECCA2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366486035"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007647cecb75a30445a6fd9fb68eba542700000000020000000000106600000001000020000000925f1548c1cdf797972f59dbf5ab3011fe2c072150c89e8d4553a92855e4b870000000000e8000000002000020000000eac6dcd095e5771d024aab301a149b44064387101469221891408d7e822d64dc20000000bc41833b7ca89d14ab750c85a02d8af63cf2f9db7b6a7ccdd7e4441dfb5bf095400000004f7f1eecf671108a98129d0d0fc9c9219a753645ce3faf8ee0fdf13d0bd7556de5c67e6411165da15e440a341596580c8786d67bc847d7d93d6dc9f5acb09905	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10157b1cf2a8d801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007647cecb75a30445a6fd9fb68eba54270000000002000000000010660000000100002000000059d5be1e457671ebd5f73d815f8911d78764b7ce523ebc89e22cdeea409ee9f8000000000e8000000002000020000000169ebaec6b4117ae697a272399f66b41c8fdf67835fececd1c4aa11a86f2ff3290000000610a6bdeb4f3ff84e371051850c7a89fe46b8f9f738891396d5b429846a309736ea4a7d43b539a1e2e7286678ac7b01c86516725278d094674340dceae514e09f34ead376717fc240b1ce790ef61d3e639b10d4fc49390e7d0ed52807d803d32121741161d58b7670cfe75a115b01d4c09538c613a137dec7d2a631f425da61f2de56a5b7be3e9c5c36638b6c29263bc40000000e65889a6a500c8b0d25c585e3eac37ff43e97d74dfb57bce3dd9a3410ee33937cdb67c0c3419d88a30e9126a80fb25b8e4864a942c6bc8537734e54e0da31355	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exe

pid process

756 chrome.exe
560 chrome.exe
560 chrome.exe
2824 chrome.exe
2832 chrome.exe
2136 chrome.exe
560 chrome.exe
560 chrome.exe

pid	process
756	chrome.exe
560	chrome.exe
560	chrome.exe
2824	chrome.exe
2832	chrome.exe
2136	chrome.exe
560	chrome.exe
560	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

iexplore.exechrome.exe

pid	process
1972	iexplore.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1972 iexplore.exe
1972 iexplore.exe
592 IEXPLORE.EXE
592 IEXPLORE.EXE
592 IEXPLORE.EXE
592 IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exechrome.exe

description	pid	process	target process
PID 1972 wrote to memory of 592	1972	iexplore.exe	IEXPLORE.EXE
PID 1972 wrote to memory of 592	1972	iexplore.exe	IEXPLORE.EXE
PID 1972 wrote to memory of 592	1972	iexplore.exe	IEXPLORE.EXE
PID 1972 wrote to memory of 592	1972	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 544	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 544	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 544	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 1952	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 756	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 756	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 756	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe
PID 560 wrote to memory of 460	560	chrome.exe	chrome.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://secure-web.cisco.com/1ELSiFNkDDcSx-trt_wLUMw_RiS1Y-2G77ua3rCp_fqqvQDi6WZVGuIE1LrvmE2KHip1cf0ziwDI6xfNPmXpSgQDHDq9ZwtuNI8KMcWyuAySzxTm49ZwYC9PdbolJCkLd882f8NDt2V8syRPjZ9YvlLzkFQ21fvf9vhptE2Wk0a_CZauVSLZ2QBHwOLpLBtKXNNcbUsKNRszNDucwAigHVCivybQzACo_R1cBoegz4jbmiKGBc7OXyZEHQHdr1bKf_XiTddOA0XAY2KMjGVbZrLPxtAomXpcTLR4GzOKlQ1SSmXrGUflkWQVxU9adrhj8/https%3A%2F%2Fycrms-tqaaa-aaaad-qdlkq-cai.raw.ic0.app%2Flogin2.html%3Fatqcrt%3D4OIpWjjHapS5ne8Vtt5FAB4dwz%26qxomhgm%3DIGT98ECRAREGFf8PJ4zvbLqu%26eoibnnpkd%3DfmONE44c9YG5uIuZ2kchvm8kkWYX%26wunazw%3DkUHmhLQEF2OBDbclEhgQeQ%26krguqcvd%3DmXX9CH4uaA9XJ6m%26mvplqtbus%3DLGljjBuJFJ9fTzJE%26username%3Dmiao.zhang%40dot.wi.gov
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66b4f50,0x7fef66b4f60,0x7fef66b4f70
2⤵
PID:544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1044 /prefetch:2
2⤵
PID:1952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1264 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 /prefetch:8
2⤵
PID:460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1
2⤵
PID:1568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
2⤵
PID:1524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
2⤵
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3324 /prefetch:2
2⤵
PID:2184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:2228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3568 /prefetch:8
2⤵
PID:2292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3664 /prefetch:8
2⤵
PID:2300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
2⤵
PID:2376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
2⤵
PID:2452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
2⤵
PID:2560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:2640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=536 /prefetch:8
2⤵
PID:2724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3728 /prefetch:8
2⤵
PID:2784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4412 /prefetch:8
2⤵
PID:2840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4200 /prefetch:8
2⤵
PID:2948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4372 /prefetch:8
2⤵
PID:3004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3452 /prefetch:8
2⤵
PID:1576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4793880432223065147,10994995599290544311,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
2⤵
PID:2304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
eec391573c2fbe2987f1da899d170781

SHA1
4e81cd8c39516b380cb92cda37d6a385aba4d27f

SHA256
be4e03a730d855dbc66300b47f24a924ae93e1bc81e28be0dd02425824c9f1fa

SHA512
8fb855f3762377357833ad5f03be003358076b8d76e538d643ab14605591170a35c97da41d594445e2638d8450418f0ac84d9f6d40e67b97403957c8fa30a828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
d3941e59066cc8a8dc27859f3dca89d0

SHA1
6fb0d744b8ad617ebe33be99f0c3b18cc812db44

SHA256
48589984299191a80c53edbc75a7ed19b125b15948a0ba7dc3126da4e7b9f9d7

SHA512
c43bba513784121612fcbae5590c53eca52e4b8553747f8480fcd6500e13be81dbabd2cbc731532b2c928e66151b216332ca681b53723430dc6cea2b0f43cac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
71e0516775bd524bc1a1cafeab0d90f6

SHA1
442d5c0d800a42f676448091f63d519ae0609267

SHA256
b7f7f3040d3e3e7bfa5590756541871139b99cb7e73e6b990049035e4e8bb3b1

SHA512
775ece1b71377cfd8e64e821163b09b6eae30af1613f70e3d3fa09740dc66f5d6077ace695ab0af97e948684467e0d713a15b6ec11428428638761ce7c83c29a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1D4YVA6Z.txt
Filesize
597B

MD5
8b75b3949964f0ba63f1ce59a471f906

SHA1
f4bd3e3da9128276790a39caa9aa8f818a198138

SHA256
609078d2b4f844f5bb957429adbb885b2a363a0421aa9cc5dfc13833828a965f

SHA512
9a173f41e41a8afc91cffdfe6fe902f1b0848e9f2c160a74e7b2c8dea5b43a150899162ba3cabfacf71a596d18a559ab595c1d88e2527806731f5c1a01cfa633

Download Submit
\??\pipe\crashpad_560_LEEVTCBMTITLRDDM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads