Analysis
-
max time kernel
135s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
05-08-2022 19:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.frontrush.com/FR_Web_App/Message/MessageTracking.aspx?code=ODYzOTUxNTsyNjM3ODcyODtSOzgxOTc7TA==-f+lhm4TMRSg=&redir=http://9615.LlwPtsVCca.mtca-jo.org/?=nora.dye@conduent.com
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
https://www.frontrush.com/FR_Web_App/Message/MessageTracking.aspx?code=ODYzOTUxNTsyNjM3ODcyODtSOzgxOTc7TA==-f+lhm4TMRSg=&redir=http://9615.LlwPtsVCca.mtca-jo.org/?=nora.dye@conduent.com
Resource
win10v2004-20220721-en
General
-
Target
https://www.frontrush.com/FR_Web_App/Message/MessageTracking.aspx?code=ODYzOTUxNTsyNjM3ODcyODtSOzgxOTc7TA==-f+lhm4TMRSg=&redir=http://9615.LlwPtsVCca.mtca-jo.org/?=nora.dye@conduent.com
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a8450716a9d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007647cecb75a30445a6fd9fb68eba54270000000002000000000010660000000100002000000016ae2cc35aca862cba26e53b8520d7805693c42aca6d2464df2e51365bc44856000000000e800000000200002000000041dadeaf3035edb4edbdae457deeba94ccffb346ec0d1a55c4fced22b52fc8d690000000a6ba7374a8aabc10fa85b71f930fc46f7bda4c00c508b94fd9185d5859e67983d60e53bf7d31824a9d0193e5c02c8666e94455415197c15595d03f714e1900c8751696377b0e7db844d80299270d420c807a6a152a343ac1be73006e02d4d0ce53c710b41bd1fb74a360860d73ffa060a8fc0d75b8a73c918087147ad8fc77774da14125edba053f3cbe02c7ae87181c40000000a239212d29de6e00a8f021b6e2f5f7e7d26ae5bd72887a0e59763aa1bbb0823ef5ed1b7229df3030bb242cd301657e72a698364c15ba0b2c8e01db47c526a397 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23E2F9C1-1509-11ED-8472-DA64C5028348} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366501430" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007647cecb75a30445a6fd9fb68eba54270000000002000000000010660000000100002000000002f43dcf853b88dcec133c842adbd56c2226902b6eba7c516d6ae6cdb447fe30000000000e8000000002000020000000f08001028d7909c991a9ef57e3cc846bf1b64ffd1128731f99ddd2e7f89de52620000000eb4cb8e8403f5815cbf3a9bf12112682d16bd895c2052cc0d659ef98f99034e640000000afdca248b95a3d80b2ec7b9540830131af696a3e4f3fbe5f5a79e49b452a3b097312283fda74cc9707a21fd02b55c60db8e2dcb11d75897d84f0d5723dbdc454 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exepid process 1668 chrome.exe 1960 chrome.exe 1960 chrome.exe 2820 chrome.exe 2836 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
Processes:
iexplore.exechrome.exepid process 792 iexplore.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
chrome.exepid process 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 792 iexplore.exe 792 iexplore.exe 1588 IEXPLORE.EXE 1588 IEXPLORE.EXE 1588 IEXPLORE.EXE 1588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 792 wrote to memory of 1588 792 iexplore.exe IEXPLORE.EXE PID 792 wrote to memory of 1588 792 iexplore.exe IEXPLORE.EXE PID 792 wrote to memory of 1588 792 iexplore.exe IEXPLORE.EXE PID 792 wrote to memory of 1588 792 iexplore.exe IEXPLORE.EXE PID 1960 wrote to memory of 804 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 804 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 804 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1976 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1668 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1668 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1668 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1220 1960 chrome.exe chrome.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.frontrush.com/FR_Web_App/Message/MessageTracking.aspx?code=ODYzOTUxNTsyNjM3ODcyODtSOzgxOTc7TA==-f+lhm4TMRSg=&redir=http://9615.LlwPtsVCca.mtca-jo.org/?=nora.dye@conduent.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:792 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ed4f50,0x7fef6ed4f60,0x7fef6ed4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1104 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1232 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1684 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3304 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3776 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4136 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1956 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1972 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4464 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,5063209786067039191,6487982283246203433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3992 /prefetch:82⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD53dcbf43590a2fa78ca0502b9f9cc20a6
SHA1c4ad40ebb2ee5d640f98ce995e0af3b454c6756c
SHA25678c833fd971fe0a9aa440b9cc0393ba6cae427b818e109076d8edfeca25c9847
SHA512247d09cffc3ba7c8470accd16c6796b6254c5a7cc46437eceda2636d04bebdb4e939314bd3670f44eac25bc7077c7ceb29ecc768c81c82cd7993aa759ef7d245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD5b5128b813c25b6f7de5274cce2c0ea02
SHA1990f21acef93029c880e3dbb12b96ae20c506bfa
SHA256455c8c027f72d47b33c40e64e7a508bc2c1e38bc65fffbe6f5569e366b84e92f
SHA5126a19893026fb2c0a7810b9cec3edbf4da6dc45601baf22c9985cd5df38dffcfdfd458ac5d7b9d9cf005f01904f11a08337d91bb86e8a1f15e468510eb5a94747
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CF7AK0W7.txtFilesize
601B
MD50cfe89a3e2f3199873fde6f977eb76dd
SHA1a9bfeed18e7b276d7154fbc20d64a1b64862a6ac
SHA2560a52a4e765fd91551d43655d1942a5691b599eac390f9dcb60764482b491d9e0
SHA5124b39f7745dc11c8ecc77a5a600f1d0275e2a93b5e0a4572f2fda31c6ea33e4680446726a5e08b6411a41d41e6db1353f2256d68dd42bf52f3d9900fd815cc6e1
-
\??\pipe\crashpad_1960_NJKHYRFHPZLZLSEVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e