Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2022 19:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.frontrush.com/FR_Web_App/Message/MessageTracking.aspx?code=ODYzOTUxNTsyNjM3ODcyODtSOzgxOTc7TA==-f+lhm4TMRSg=&redir=http://9615.LlwPtsVCca.mtca-jo.org/?=nora.dye@conduent.com
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
https://www.frontrush.com/FR_Web_App/Message/MessageTracking.aspx?code=ODYzOTUxNTsyNjM3ODcyODtSOzgxOTc7TA==-f+lhm4TMRSg=&redir=http://9615.LlwPtsVCca.mtca-jo.org/?=nora.dye@conduent.com
Resource
win10v2004-20220721-en
General
-
Target
https://www.frontrush.com/FR_Web_App/Message/MessageTracking.aspx?code=ODYzOTUxNTsyNjM3ODcyODtSOzgxOTc7TA==-f+lhm4TMRSg=&redir=http://9615.LlwPtsVCca.mtca-jo.org/?=nora.dye@conduent.com
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecbea742cdd51744a22318f0bb77b68200000000020000000000106600000001000020000000011fd584d9009e40f3372f0b41978dfc4322df753f2251b240476d4aeea830cc000000000e80000000020000200000003b2dbbeb72cbf625ad962a1502084bdd4832cc835899901c04db8455495f9e032000000070b7dd6767970a93afccbce9288758295f9cbf72cbaa265d636f0a06a292901740000000bea38d5f6d592a0256e9662a20138a7e31db24f0e4ad0483e3d347966313ca971a133eb8764a296de87d4ce4e8740bc62a7369e7b78a88de0453fb596e6f780e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4190989308" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30976277" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70598efa15a9d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30976277" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4190989308" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4190832374" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30976277" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30976277" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecbea742cdd51744a22318f0bb77b6820000000002000000000010660000000100002000000065afe06bcdec8441f3961a11157feae143ef77fad182b5f4ad46566d8b7cf58f000000000e80000000020000200000002e2885e8dde99a405de7bf279a03b18dfb7ae3469ea0ad63dcbd57927a6c4cee2000000029f26a4e6db025d9e22b4f48f67223c5606859dcdf808d4f7f21de8b24646ac2400000009db5956c6c329f7861106d8e7704c5f7003539610b7bfe9952dc01122f11c74a6f2075a7cb71e909e31bb676ef43369e46d115ba8ba06d3d2760d680fba1369e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b276fa15a9d801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4190832374" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "365898334" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{23D06C8B-1509-11ED-BFB6-52E8404D0F63} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2372564722-193526734-2636556182-1000\{FA7225EB-EB32-48DE-985C-AF2935C846DF} chrome.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exepid process 4332 chrome.exe 4332 chrome.exe 4368 chrome.exe 4368 chrome.exe 5124 chrome.exe 5124 chrome.exe 5540 chrome.exe 5540 chrome.exe 5640 chrome.exe 5640 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
chrome.exepid process 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
iexplore.exechrome.exepid process 1384 iexplore.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe 4368 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1384 iexplore.exe 1384 iexplore.exe 1768 IEXPLORE.EXE 1768 IEXPLORE.EXE 1768 IEXPLORE.EXE 1768 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 1384 wrote to memory of 1768 1384 iexplore.exe IEXPLORE.EXE PID 1384 wrote to memory of 1768 1384 iexplore.exe IEXPLORE.EXE PID 1384 wrote to memory of 1768 1384 iexplore.exe IEXPLORE.EXE PID 4368 wrote to memory of 4716 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4716 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4316 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4332 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4332 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe PID 4368 wrote to memory of 4112 4368 chrome.exe chrome.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.frontrush.com/FR_Web_App/Message/MessageTracking.aspx?code=ODYzOTUxNTsyNjM3ODcyODtSOzgxOTc7TA==-f+lhm4TMRSg=&redir=http://9615.LlwPtsVCca.mtca-jo.org/?=nora.dye@conduent.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1384 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8404a4f50,0x7ff8404a4f60,0x7ff8404a4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2012 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4532 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4616 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4696 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5420 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5076 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5084 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5720 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5756 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5592 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,477028303038568549,17834524774672038187,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\crashpad_4368_CRDFBPMXVFKAGIKRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e